
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Easily create a mock server based on your filesytem dir structure.
NPM
npm install dicoy
PNPM
pnpm add dicoy
Yarn
yarn add dicoy
Create a project with following structure
mock-server
├── dicoy.config.json
├── package.json
└── src
├── server-1
│ ├── me
│ │ └── GET.json
│ └── send
│ └── POST.json
└── server-2
└── users
├── :userId
│ └── GET.json
└── GET.JSON
npm install dicoy
# pnpm install dicoy
# yarn add dicoy
dicoy.config.json{
"$schema": "node_modules/dicoy/$schema.config.json",
"servers": [
{
"name": "server-1",
"src": "src/server-1",
"port": 9001,
"basePath": "/api"
},
{
"name": "server-2",
"src": "src/server-2",
"port": 9002,
"basePath": "/"
}
]
}
src/server-1/me/GET.json{
"data": {
"name": "Jon Doe",
"email": "jon.doe@exmaple.com",
"org": "Dunder Mifflin"
}
}
src/server-1/send/POST.json{
"inputValidator": {
"title": "string",
"email": "string.email",
"body?": "string"
},
"data": {
"message": "Successfully created"
}
}
src/server-2/users/GET.json{
"data": [
{
"id": 1,
"name": "Jon Doe",
"email": "jon.doe@exmaple.com",
"org": "Dunder Mifflin"
},
{
"id": 2,
"name": "Peter Parker",
"email": "peter.parker@exmaple.com",
"org": "Dunder Mifflin"
}
]
}
src/server-2/users/:userId/GET.json{
"data": {
"title": "Example of dynamic route"
}
}
dev script to your package.json{
"scripts": {
"dev": "dicoy serve"
}
}
npm run dev
# pnpm run dev
# yarn dev
🎉 Your mock server is now running
Try CURL some end points
curl localhost:9001/api/me
## `/api` is prefixed because it is defined in `dicoy.config.json` as `basePath`
# {
# "name": "Jon Doe",
# "email": "jon.doe@exmaple.com",
# "org": "Dunder Mifflin"
# }
curl localhost:9001/api/send --data '{"title": "Hello", "email": "bad-email"}' -v
## Bad input response because validation failed for email
# * Host localhost:9001 was resolved.
# * IPv6: ::1
# * IPv4: 127.0.0.1
# * Trying [::1]:9001...
# * Connected to localhost (::1) port 9001
# > POST /api/send HTTP/1.1
# > Host: localhost:9001
# > User-Agent: curl/8.7.1
# > Accept: */*
# > Content-Length: 40
# > Content-Type: application/x-www-form-urlencoded
# >
# * upload completely sent off: 40 bytes
# < HTTP/1.1 400 Bad Request
# < Content-Type: application/json
# < Date: Fri, 10 Oct 2025 12:53:42 GMT
# < Connection: keep-alive
# < Keep-Alive: timeout=5
# < Transfer-Encoding: chunked
# <
# * Connection #0 to host localhost left intact
# [{"message":"an email address","path":["email"]}]%
curl localhost:9001/api/send --data '{"title": "Hello", "email": "user@example.com"}'
# {"message":"Successfully created"}
curl localhost:9002/users/2
## Matching /users/:userId/GET.json in `server-2` directory
# {"title":"Example of dynamic route"}
npm install --global dicoy
# pnpm install --global dicoy
# yarn global add dicoy
dicoy serve
| Option | Default value | Description |
|---|---|---|
| --name | Name for your server. This name is prefixed in logs | |
| --src | . | Source directory of your file base mock server |
| --port | 8080 | Port for your server |
| --basePath | Path prefix for your api routes |
Typescript equivalent type of dicoy.config.json is defined by the type DicoyServerConfig below.
type ServerEntry = {
name?: string
src?: string
port?: string
basePath?: string
}
type DicoyServerConfig = {
servers: ServerEntry[]
}
Response file is defined as <http method in upper case>.json.
{
"data": "..content..."
}
dataData can be string, json object or json array. The Content-type header is inferred as text/plain if data is string and application/json otherwise, unless an explicit Content-Type header is declared.
headersA map of headers to be sent back.
inputValidatorThis can be defined any non-GET requests. For validation Arktype is used. The value can be anything that is understood by Arktype in json format.
FAQs
Easily create a mock server based on your filesytem dir structure.
We found that dicoy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.