
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Replace port numbers with stable, named .localhost URLs. For humans and agents. (Formerly portless)
[!NOTE] 📌 Fork Notice: This is a continuation fork of vercel-labs/portless. We maintain and extend the project with additional features and platform support.
[!IMPORTANT] 🪟 Windows Support Added! This fork includes full Windows support alongside macOS and Linux. No platform limitations!
Replace port numbers with stable, named .localhost URLs. For humans and agents.
- "dev": "next dev" # http://localhost:3000
+ "dev": "peakroute myapp next dev" # http://myapp.localhost:1355
# Install
npm install -g peakroute
# Start the proxy (once, no sudo needed)
peakroute proxy start
# Run your app (auto-starts the proxy if needed)
peakroute myapp next dev
# -> http://myapp.localhost:1355
The proxy auto-starts when you run an app. You can also start it explicitly with
peakroute proxy start.
Local dev with port numbers is fragile:
EADDRINUSElocalhost bleed across apps on different ports; localStorage is lost when ports shift.env files all break when ports changelocalhost:3000 is a jumble of unrelated projectsPeakroute fixes all of this by giving each dev server a stable, named .localhost URL that both humans and agents can rely on.
# Basic
peakroute myapp next dev
# -> http://myapp.localhost:1355
# Subdomains
peakroute api.myapp npm start
# -> http://api.myapp.localhost:1355
peakroute docs.myapp next dev
# -> http://docs.myapp.localhost:1355
{
"scripts": {
"dev": "peakroute myapp next dev"
}
}
The proxy auto-starts when you run an app. Or start it explicitly: peakroute proxy start.
flowchart TD
Browser["Browser<br/>myapp.localhost:1355"]
Proxy["peakroute proxy<br/>(port 1355)"]
App1[":4123<br/>myapp"]
App2[":4567<br/>api"]
Browser -->|port 1355| Proxy
Proxy --> App1
Proxy --> App2
peakroute proxy startpeakroute <name> <command> assigns a free port and registers with the proxyhttp://<name>.localhost:1355 routes through the proxy to your appApps are assigned a random port (4000-4999) via the PORT and HOST environment variables. Most frameworks (Next.js, Express, Nuxt, etc.) respect these automatically. For frameworks that ignore PORT (Vite, Astro, React Router, Angular), peakroute auto-injects the correct --port and --host flags.
Enable HTTP/2 for faster dev server page loads. Browsers limit HTTP/1.1 to 6 connections per host, which bottlenecks dev servers that serve many unbundled files (Vite, Nuxt, etc.). HTTP/2 multiplexes all requests over a single connection.
# Start with HTTPS/2 -- generates certs and trusts them automatically
peakroute proxy start --https
# First run prompts for sudo once to add the CA to your system trust store.
# After that, no prompts. No browser warnings.
# Make it permanent (add to .bashrc / .zshrc)
export PEAKROUTE_HTTPS=1
peakroute proxy start # HTTPS by default now
# Use your own certs (e.g., from mkcert)
peakroute proxy start --cert ./cert.pem --key ./key.pem
# If you skipped sudo on first run, trust the CA later
sudo peakroute trust
peakroute <name> <cmd> [args...] # Run app at http://<name>.localhost:1355
peakroute list # Show active routes
peakroute trust # Add local CA to system trust store
peakroute alias <host> <port> # Register external service (e.g., Docker)
peakroute alias remove <host> # Remove an external route
# Disable peakroute (run command directly)
PEAKROUTE=0 bun dev # Bypasses proxy, uses default port
# Also accepts PEAKROUTE=skip
# Proxy control
peakroute proxy start # Start the proxy (port 1355, daemon)
peakroute proxy start --https # Start with HTTP/2 + TLS
peakroute proxy start -p 80 # Start on port 80 (requires sudo)
peakroute proxy start --foreground # Start in foreground (for debugging)
peakroute proxy stop # Stop the proxy
# Options
-p, --port <number> # Port for the proxy (default: 1355)
# Ports < 1024 require sudo
--https # Enable HTTP/2 + TLS with auto-generated certs
--cert <path> # Use a custom TLS certificate (implies --https)
--key <path> # Use a custom TLS private key (implies --https)
--no-tls # Disable HTTPS (overrides PEAKROUTE_HTTPS)
--foreground # Run proxy in foreground instead of daemon
--force # Override a route registered by another process
# Environment variables
PEAKROUTE_PORT=<number> # Override the default proxy port
PEAKROUTE_HTTPS=1 # Always enable HTTPS
PEAKROUTE_STATE_DIR=<path> # Override the state directory
# Info
peakroute --help # Show help
peakroute --version # Show version
Peakroute stores its state (routes, PID file, port file) in a directory that depends on the proxy port:
/tmp/peakroute -- shared between root and user processes~/.peakroute -- user-scoped, no root involvementOverride with the PEAKROUTE_STATE_DIR environment variable if needed.
Use the peakroute alias command to register routes for services not spawned by peakroute, such as Docker containers or other external processes:
# Register a Docker container running on port 3000
peakroute alias mydocker.localhost 3000
# Now access it at http://mydocker.localhost:1355
# Remove the alias when done
peakroute alias remove mydocker.localhost
Aliases are marked with [external] in the route list and are never cleaned up as "stale" since they don't have an associated process PID.
peakroute list
# -> http://mydocker.localhost:1355 -> localhost:3000 (pid 0) [external]
Peakroute automatically detects when you're running inside a Git Worktree and prepends the branch name as a subdomain prefix. This gives each worktree a unique URL without any configuration changes.
# In a worktree on branch feat/login
peakroute myapp next dev
# -> http://feat-login.myapp.localhost:1355
# In a worktree on branch fix/auth-bug
peakroute api next dev
# -> http://fix-auth-bug.api.localhost:1355
The branch name is sanitized for use as a hostname (slashes become hyphens, invalid characters are removed).
This repo is a Bun workspace monorepo using Turborepo. The publishable package lives in packages/peakroute/.
bun install # Install all dependencies
bun run build # Build all packages
bun run test # Run tests
bun run test:coverage # Run tests with coverage
bun run test:watch # Run tests in watch mode
bun run lint # Lint all packages
bun run typecheck # Type-check all packages
bun run format # Format all files with Prettier
If your frontend dev server (e.g. Vite, webpack) proxies API requests to another peakroute app, make sure the proxy rewrites the Host header. Without this, the proxy sends the original Host header, causing peakroute to route the request back to the frontend in an infinite loop.
Vite (vite.config.ts):
server: {
proxy: {
"/api": {
target: "http://api.myapp.localhost:1355",
changeOrigin: true, // Required: rewrites Host header to match target
ws: true,
},
},
}
webpack-dev-server (webpack.config.js):
devServer: {
proxy: [{
context: ["/api"],
target: "http://api.myapp.localhost:1355",
changeOrigin: true, // Required: rewrites Host header to match target
}],
}
Peakroute detects this misconfiguration and responds with 508 Loop Detected along with a message pointing to this fix.
FAQs
Replace port numbers with stable, named .localhost URLs. For humans and agents. (Formerly portless)
We found that peakroute demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.