
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
interceptr
Advanced tools
Local HTTP proxy for mocking, intercepting and delaying API calls. Import OpenAPI/Swagger specs and control every endpoint from a browser UI — no code changes needed.
A local HTTP proxy for mocking, intercepting, and delaying API calls — with a browser-based UI.
Import your OpenAPI / Swagger spec, control each endpoint individually (pass, delay, mock, or both), and watch live traffic in real time. No code changes. No config files. Just run it and point your app at the proxy.
npx interceptr
Then open http://localhost:3001 in your browser. Point your app (or Postman, curl, etc.) at http://localhost:4000 — traffic will be intercepted and handled based on your settings.
# Install globally
npm install -g interceptr
interceptr --port 3001
| Flag | Alias | Default | Description |
|---|---|---|---|
--port | -p | 3001 | Port for the management UI and API |
Interceptr runs as a local reverse proxy that sits between your frontend (or any HTTP client) and your real backend. Once your OpenAPI/Swagger spec is imported, you can control every endpoint without touching your application code:
Click Select Spec in the header → + → paste a URL (e.g. https://petstore.swagger.io/v2/swagger.json) or upload a .json / .yaml file.
The Endpoints Registry lists every operation from your spec, grouped by tag.
| Mode | Behavior |
|---|---|
| Pass | Forwards the request to the upstream server unchanged. |
| Delay | Simulates latency. Configure milliseconds and optional jitter. |
| Mock | Returns a custom response. Use spec-defined examples or write your own JSON. |
| Delay + Mock | Returns a mock response after the configured delay. Activate by clicking both the Delay and Mock buttons simultaneously. |
Click an endpoint to open the editor. Use group action buttons (Pass / Delay / Mock) above each tag group to apply a mode to all endpoints at once.
The Traffic Monitor (right panel) streams every request in real time. Click any entry to inspect the full request/response — headers, status code, body, and matched endpoint.
The Preset Bar lets you save and restore complete endpoint configurations. Built-in quick actions:
Set your app's base URL (or HTTP_PROXY / HTTPS_PROXY env var) to http://localhost:4000. All matching traffic will be intercepted.
┌─────────────────────────────────────────────┐
│ pnpm monorepo │
├──────────────┬──────────────┬───────────────┤
│ apps/server │ apps/web │ packages/ │
│ │ │ shared │
│ Hono API │ React 19 │ TypeScript │
│ :3001 │ Vite :5173 │ types │
│ │ │ │
│ Proxy │ Tailwind v4 │ │
│ :4000 │ TanStack │ │
└──────────────┴──────────────┴───────────────┘
| Component | Stack |
|---|---|
| Management API | Hono on port 3001 |
| Proxy Server | Hono on port 4000 |
| Frontend | React 19, Vite, Tailwind v4, TanStack Query, React Router v7 |
| Storage | JSON files in data/ |
| Live Feed | Server-Sent Events (SSE) |
| Testing | Vitest, Testing Library |
The management API runs on port 3001. All endpoints are prefixed with /api.
| Method | Path | Description |
|---|---|---|
GET | /projects | List all projects |
POST | /projects | Create a project (body: {name}) |
GET | /projects/active | Get active project with specs |
PUT | /projects/active | Switch active project (body: {projectId}) |
PUT | /projects/:id | Rename a project (body: {name}) |
DELETE | /projects/:id | Delete a project |
| Method | Path | Description |
|---|---|---|
GET | /specs | List specs in the active project |
POST | /specs | Upload a spec (body: {spec, name, upstreamUrl?}) |
POST | /specs/url | Import a spec from URL (body: {url, name}) |
POST | /specs/:id/reimport | Reimport from source URL or new body |
PUT | /specs/:id | Update spec metadata (body: {name?, upstreamUrl?, active?, globalHeaders?, applyGlobalHeadersToAll?}) |
PUT | /specs/:id/toggle | Toggle spec active state |
DELETE | /specs/:id | Delete a spec |
| Method | Path | Description |
|---|---|---|
GET | /endpoints | List endpoints (query: ?specId=...) |
PUT | /endpoints/:id | Update endpoint config |
PUT | /endpoints/bulk | Bulk update endpoints (body: {[id]: Partial<EndpointConfig>}) |
The endpoint config supports a conditionalRules array for request-time overrides. Each rule has a type of nth-request, random-failure, or header-match, and a response served when triggered.
| Method | Path | Description |
|---|---|---|
GET | /presets | List saved presets |
POST | /presets | Save a preset (body: {name, description?, endpoints}) |
DELETE | /presets/:name | Delete a preset |
POST | /presets/:name/apply | Apply a preset to all endpoints |
| Method | Path | Description |
|---|---|---|
GET | /logs | Fetch recent logs (query: ?limit=100) |
GET | /logs/stream | SSE stream for live logs |
DELETE | /logs | Clear all logs |
| Method | Path | Description |
|---|---|---|
GET | /proxy/status | Proxy running status ({running, port}) |
POST | /proxy/start | Start the proxy server |
POST | /proxy/stop | Stop the proxy server |
| Method | Path | Description |
|---|---|---|
GET | /config | Get global config |
PUT | /config | Update global config (body: {proxyPort?}) |
GET | /config/export | Export all data as JSON |
POST | /config/import | Import configuration from JSON |
| Method | Path | Description |
|---|---|---|
GET | /health | Health check — returns {status: "ok", version} |
All data is stored as JSON files in the data/ directory:
data/
global.json # Global config + project list
logs.json # Activity logs (500-entry ring buffer)
projects/
<project-id>.json # Specs, endpoints, and presets per project
Writes are debounced (1 second) to avoid excessive disk I/O.
pnpm install
pnpm dev
Starts:
pnpm test
pnpm build && pnpm start
FAQs
Local HTTP proxy for mocking, intercepting and delaying API calls. Import OpenAPI/Swagger specs and control every endpoint from a browser UI — no code changes needed.
We found that interceptr demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.