
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
stubborn-server
Advanced tools
NodeJS Stub server for test and dev purposes
Is your backend stubborn?
Ok... create a stubborn.js file where you want to use it content might look like
module.exports = {
logMode: 'all', // can be 'all', 'info', 'mock', 'warn', 'error' or 'none'
namespace: '', // help switching between different senarios
pathToMocks: 'mock-examples', // mock folder relative path
servePort: 8059,
includes: ['__custom/express_handlers'], // List of files into the mock folder where the express app will be exposed for custom handling
fallbacks: [
{ // using "path" key tells that we refer to a local file
url: '/assets/*',
path: '/path/to/static/folder'
},
{ // using "target" key tells that we refer to an http location and is treated as a server proxy
url: '/*':,
target: 'localhost:3000'
},
{ // using "mock" key tells that we refer to an existing mock, a direct regex can be used here
url: /api\/path\/([^\/]+)/,
mock: 'api/path/__wildcard__/more/paths'
}
]
};
or a stubborn.json file
{
"logMode": "mock",
"namespace": "",
"pathToMocks": "mock-examples",
"servePort": 8059,
"includes": ["__custom/express_handlers"],
"fallbacks": [
{
"url": "/assets/*",
"path": "/path/to/static/folder"
},
{
"url": "/*",
"target": "localhost:3000"
},
{
"url": "api\/path\/([^\/]+)",
"target": "api/path/__wildcard__/more/paths"
}
]
}
Then write your initiator like the one given in demo.js or in tests/...
Might look like this :
const stubbornServer = require('stubborn-server');
const stub = stubbornServer();
stub.start(/* config to extend ./stubborn.js if required */);
// from this point, you may run your queries
stub.config.set({
namespace: 'alt'
});
// from this point, you may run other queries
stub.stop();
I also have the intention of having this available directly from the command line.
Mocks can be specified in three ways:
The way you choose depends on the needs of your project. You may also mix and match as the options are not exclusive.
When creating your mock server, a reference to the underlying raw express app is available. You can attach any response handlers you want:
const stubbornServer = require('stubborn-server');
const stub = stubbornServer();
// Attaching express handlers directly via `app` raw reference.
stub.app.use('/my/url/path', (req, res) => {
// req / res are from express
console.log(req.method);
const response = {'hello': 'world'};
// stub is stubborn server object
console.log(stub.config.get());
res.json(response);
});
stub.start();
// from this point, you may run your queries
stub.stop();
Instead of manually attaching handlers to the app, you may specify paths to
express handlers. The handlers will then be require()ed for you.
This example is functionally equivalent to the example above:
main.js:
const stubbornServer = require('stubborn-server');
const stub = stubbornServer();
stub.config.set({
includes: ['path/to/handler.js'],
});
stub.start();
// from this point, you may run your queries
stub.stop();
handler.js:
module.exports = (app, stub) => {
app.use('/my/url/path', (req, res) => {
// req / res are from express
console.log(req.method);
const response = {'hello': 'world'};
// stub is stubborn server instance
console.log(stub.config.get());
res.json(response);
});
};
By default, when the server recieves a request it will look into the directory
specified by the pathToMocks configuration option for a mock response.
The file name serving as a mock must match the request path plus the request method.
For example, a POST request to http://localhost:3000/api/service will try
to find files at the following locations:
/path/to/mocks/api/service/post.js/path/to/mocks/api/service/post.json/path/to/mocks/api/service/post/index.js/path/to/mocks/api/service/post/index.jsonBasically, it's a require.resolve that finds the proper mock response files.
The following is an example of a basic configuration driven post.js mock:
// this function is the handler being called
module.exports = (req, res, stub) => {
// req / res are from express
console.log(req.method); // POST
// stub is stubborn server object
console.log(stub.config.get());
res.json({ 'hello': 'world' });
};
and a post.json mock that returns the same mock response data:
{
"hello": "world"
}
A plugin architecture allows you to extend even more the custom functionality of your server.
Add your own custom loader that takes precedence over the default behavior of file system lookup and the fallbacks property - this way even if your loader throws you can still rely on the standard functionality.
Here is an example of a custom loader that uses sent data in order to load a mock:
const stubbornServer = require('stubborn-server');
const stub = stubbornServer();
stub.start({
plugins: [
{
loader: (req, { pathToMocks }) => {
return require(path.join(pathToMocks, req.body.data);
}
}
]
});
NOTE: you may also define multiple loaders, allowing you to have multiple custom fallbacks systems.
GPL-3.0 © 2018 Olivier Rousseau-Guyot
FAQs
NodeJS Stub server for test and dev purposes
The npm package stubborn-server receives a total of 141 weekly downloads. As such, stubborn-server popularity was classified as not popular.
We found that stubborn-server demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.