
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
bun-reverse-proxy
Advanced tools

A zero-config reverse proxy for local development with SSL support, custom domains, and more.
/etc/hosts Management (auto-updating)bun install -d bun-reverse-proxy
Alternatively, you can install:
brew install reverse-proxy # wip
pkgx install reverse-proxy # wip
There are two ways of using this reverse proxy: as a library or as a CLI.
Given the npm package is installed:
import { startProxy } from 'bun-reverse-proxy'
startProxy({
from: 'localhost:3000',
to: 'my-project.localhost' // or try 'my-project.test'
})
reverse-proxy --from localhost:3000 --to my-project.localhost
reverse-proxy --from localhost:8080 --to my-project.test --keyPath ./key.pem --certPath ./cert.pem
reverse-proxy --help
reverse-proxy --version
The Reverse Proxy can be configured using a reverse-proxy.config.ts (or reverse-proxy.config.js) file and it will be automatically loaded when running the reverse-proxy command.
// reverse-proxy.config.ts (or reverse-proxy.config.js)
export default {
'localhost:3000': 'stacks.localhost'
}
Then run:
reverse-proxy start
To learn more, head over to the documentation.
bun test
Please see our releases page for more information on what has changed recently.
Please review the Contributing Guide for details.
For help, discussion about best practices, or any other conversation that would benefit from being searchable:
For casual chit-chat with others using this package:
Join the Stacks Discord Server
Two things are true: Stacks OSS will always stay open-source, and we do love to receive postcards from wherever Stacks is used! 🌍 We also publish them on our website. And thank you, Spatie
Our address: Stacks.js, 5710 Crescent Park #107, Playa Vista 90094, CA.
We would like to extend our thanks to the following sponsors for funding Stacks development. If you are interested in becoming a sponsor, please reach out to us.
The MIT License (MIT). Please see LICENSE for more information.
Made with 💙
FAQs
A modern reverse proxy, powered by Bun.
We found that bun-reverse-proxy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.