
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
serverless-serve
Advanced tools
Local lambda HTTP serve plugin for Serverless framework, a.k.a. API Gateway simulator.
When developing with Serverless deploying functions to AWS after each change might be annoying. This plugin allows you to simulate API Gateway locally, so all function calls can be done on localhost.
In your Serverless project:
npm install serverless-serve
Then in s-project.json add following entry to plugins array:
"serverless-serve"
E.g. like this:
plugins: ["serverless-serve"]
And in main project root do:
sls serve start
--prefix -p: Add prefix to the URLs, so your clients will not use http://localhost:1465/ but http://localhost:1465/prefix/ instead. Default: empty
--port -P: Port to listen on. Default: 1465
--stage -s & --region -r: If both are given (or there is only 1 region and stage is given), then endpoint response definition will get the template/variable resolved.
--init -i: Initialization file, for custom initializations. Default: empty. NOTE: please specify relative paths from project root folder, e.g. sls serve start -i ./lib/my_init.js. Init file should export single function taking following parameters:
Serverless objectapp object from Express (e.g. to register new routes)handlers object being map of all function names to info about their respective handlers. Since all handlers are require'd lazily, this plugin exports only path information about handler, in following format:{
path: "path/to/be/required",
handler: "exported-function-name"
}
so this should work: require( handlers[ myFunName ].path )[ handlers[ myFunName ].handler ]( event, context )
Example:
module.exports = function(S, app, handlers){
}
Just send your requests to http://localhost:1465/ as it would be API Gateway.
Using of this plugin with some tool like Nodemon is advised, so Serverless with restart and reload your local code after every change.
Optionaly, your handlers can be required with babel-register.
To do so, in your s-project.json file, set options to be passed to babel-register like this:
{
/* ... */
"custom": {
"serverless-serve": {
"babelOptions": {
/* Your own options, example: */
presets: ["es2015", "stage-2"]
}
}
},
"plugins": ["serverless-serve", /* ... */]
}
To view the full list of babel-register options, click here
This plugin simulates API Gateway for many practical purposes, good enough for development - but is not a perfect simulator. Specifically, no timeout or memory limits are enforced. Mapping templates and/or error codes are not simulated, either. So are security checks. You will probably find other differences.
FAQs
Local lambda HTTP serve plugin for Serverless framework, a.k.a. API Gateway simulator.
We found that serverless-serve demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.