
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Zero config, one step local https server with custom local domain.
What it does?
/etc/hostsDemo

import { createHttpsDevServer } from 'easy-https';
async function start() {
const server = await createHttpsDevServer(
async (req, res) => {
res.statusCode = 200;
res.write('ok');
res.end();
},
{
domain: 'my-app.dev',
port: 3000,
subdomains: ['test'], // will add support for test.my-app.dev
openBrowser: true,
},
);
}
start();
import { createHttpsDevServer } from 'easy-https';
import express from 'express';
const app = express();
createHttpsDevServer(app, config);
import { createHttpsDevServer } from 'easy-https';
import next from 'next';
import { parse } from 'url';
const app = next({ dev: IS_DEV });
const requestHandler = app.getRequestHandler();
async function start() {
await app.prepare();
const { server, url } = await createDevServer((req, res) => {
const parsedUrl = parse(req.url!, true);
requestHandler(req, res, parsedUrl);
}, config);
logger.log(`Server ready. 🚀`);
}
start();
interface ServerConfig {
// Main Local domain
domain: string;
// Local port to listen on
port: number;
// List of subdomains
subdomains?: string[];
// If should open web browser when server is ready
openBrowser?: boolean;
// Custom logger - defaults to console.info
logger?: (...args: any) => void;
}
function createHttpsDevServer(
// Normal node.js (req, res) handler.
handler: RequestListener,
config: ServerConfig,
): Promise<{
// https local server url.
url: string;
// Node https server instance
server: Server;
}>;
NEVER USE IN PRODUCTION
This lib is intended to make it easy to setup local https server with custom local domain. It is not meant to be secure in any way.
It is not tested on Windows. If you want, feel free to send proper PR adding Windows support.
Mit.
FAQs
Zero config, one step local https server with custom local domain.
We found that easy-https demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.