
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@maxiviper117/devproxy
Advanced tools
Cross-platform CLI for stable HTTPS local domains that proxy to local development services.

.local domains for local developmentDevProxy is a cross-platform CLI for stable HTTPS .local domains that proxy to local development services on Windows, macOS, and Linux. On Windows, it also works well with apps running in WSL, Docker, or native Windows processes as long as the service is reachable through loopback.
Full documentation is hosted at https://maxiviper117.github.io/dev-proxy/.
Install Caddy and trust its CA:
scoop install caddy
caddy trust
On macOS, brew install caddy is the common install path. On Linux, use the official packages for your distribution. See the docs for the full Windows, macOS, and Linux setup guide.
Install DevProxy:
npm install -g @maxiviper117/devproxy
Run your local project on a port (for example, 8000).
[!IMPORTANT] Elevated permissions required: This next step (4) modifies your system hosts file, so you must run it in an administrator / elevated terminal session (Windows: run Terminal/PowerShell as Administrator; macOS/Linux: use
sudo).
Register the service:
Option A — Quick registration (can be run from anywhere):
devproxy add api.myapp --port 8000
Option B — Project-scoped registration (run inside your project directory):
devproxy init --name api.myapp --port 8000
init does two things:
add) — adds the domain to DevProxy's registry, updates your hosts file, and reloads Caddy..devproxy/config.json in your current directory, saving the service name and port.Because the config lives in your project, you can re-run devproxy init later without remembering the original flags. Commit .devproxy/config.json to version control so your team can run the same command to set up the project locally.
Open your domain:
https://api.myapp.local
[!TIP] If you registered with
init, you can also rundevproxy openfrom your project root (where.devproxy/config.jsonexists) and it will open the domain directly in your browser.
| Command | Description |
|---|---|
devproxy init --name <name> --port <port> | Register a service and create project config in one step |
devproxy add <name> --port <port> | Register a new service |
devproxy open [name] | Open a service in your browser |
devproxy list | List all registered services |
devproxy status | Report Caddy state and upstream health |
devproxy remove <name> | Remove a registered service |
devproxy doctor | Check setup and diagnostics |
devproxy sync-hosts | Align DevProxy hosts entries with the registry |
devproxy start | Start or reload Caddy |
devproxy stop | Stop Caddy |
PATHFAQs
Cross-platform CLI for stable HTTPS local domains that proxy to local development services.
The npm package @maxiviper117/devproxy receives a total of 30 weekly downloads. As such, @maxiviper117/devproxy popularity was classified as not popular.
We found that @maxiviper117/devproxy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.