
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
> 一个现代化、基于 ESM 的 CORS 代理服务,重构自 [cors-anywhere](https://github.com/Rob--W/cors-anywhere)。
一个现代化、基于 ESM 的 CORS 代理服务,重构自 cors-anywhere。
cors-anywhere 的核心代理能力,解决跨域资源访问问题。nodemon 实现热重载,vitest 提供快速的单元测试体验。eslint 和 prettier 保证代码风格一致性和高质量。安装依赖
pnpm install
启动开发服务器
pnpm dev
服务将默认启动在 http://localhost:4399。
本项目提供了 Dockerfile,支持通过 Docker 进行构建和部署。
构建并运行生产环境镜像:
# 构建镜像
docker build -t cors-sp:latest --target prod .
# 运行容器
docker run -d --name cors-sp -p 4399:4399 cors-sp:latest
你也可以使用 Docker 来运行测试:
# 构建开发环境镜像并运行测试
docker build -t cors-sp-dev --target dev .
cors-sp/
├── src/
│ ├── server.js # 服务器入口
│ ├── proxyHandler.js # 核心代理逻辑
│ ├── urlParser.js # URL 解析
│ ├── cors.js # CORS 请求处理
│ └── utils.js # 工具函数
├── test/
│ └── api.test.js # API 测试
├── package.json
└── README.md
originBlacklist / originWhitelist:来源黑/白名单,用于控制允许访问的来源。requireHeader:要求请求中必须包含的头部字段。removeHeaders / setHeaders:在转发请求前移除或设置特定的请求头。checkRateLimit:自定义函数,用于实现速率限制。redirectSameOrigin:当请求目标与代理同源时,执行重定向。http://localhost:4399/ 返回说明页。README.md、docs/quick-start.md、docs/server-usage.md、docs/api-reference.md。cors-anywhere 迁移核心逻辑,并进行现代化改造。server.js: 创建并启动 HTTP 服务器。proxyHandler.js: 实现核心反向代理功能,使用 http-proxy 转发请求。cors.js: 增加 CORS 头部处理逻辑,以允许跨域请求。urlParser.js: 添加 URL 解析和验证逻辑。nodemon 用于开发环境下的文件监听和服务器自动重启。vitest 测试框架,并编写了基础的 API 测试用例 (api.test.js)。tldjs 替代过时的 regexp-tld 用于顶级域名解析。eslint 和 prettier 来规范代码风格。运行以下命令来执行单元测试:
pnpm test
提示:直接访问根路径 http://localhost:4399/ 将返回一页简要说明(文档页),用于快速检查服务运行状态与了解基本用法。
快速验证:
GET http://localhost:4399/ # 返回说明页
GET http://localhost:4399/https://api.github.com/users/octocat
http://localhost:4399/ 返回简要说明页,便于快速验证与了解用法。README.md、docs/quick-start.md、docs/server-usage.md、docs/api-reference.md。FAQs
> 一个现代化、基于 ESM 的 CORS 代理服务,重构自 [cors-anywhere](https://github.com/Rob--W/cors-anywhere)。
The npm package cors-sp receives a total of 1 weekly downloads. As such, cors-sp popularity was classified as not popular.
We found that cors-sp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.