
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Lightweight CLI tool for local developement of serverless Google Cloud Functions
Coppa was made for developers working with google cloud serverless functions. Coppa creates a local dev server that mimicks deployed cloud functions.
Coppa is different from Google Cloud Functions NodeJS Emulator because it does not require devs to deploy each function locally. Coppa just reads your yaml file and your main index file and spins up a quick dev server for easy and painless debugging and development.
Coppa even provides a free documentation page auto generated based on your functions, by leveraging the npm package quantor.
This is a CLI tool so it's best to install globally for convenience.
Yarn:
yarn global add coppa
NPM:
npm i -g coppa
cd into your app directory that contains your serverless.yml file and your main index.js file that holds all your cloud functions, then run:
coppa start
This command will start the dev server using the default arguments for locating files, which is ./serverless.yml for the serverless yaml, and ./index.js for the main entry point.
These can be changed by passing in flags to Coppa. To see all the flags, run:
coppa start --help
To use any flag, include it in the command:
coppa start -c path/to/serverless.yml -p 9001
Hot reloading with nodemon
nodemon --exec coppa start
Here are all the available flags for the start command.
-c, --config [path] Path to serverless config file (default: ./serverless.yml)-e, --entry [path] Path to JS entry point file (default: ./index.js)-s, --stage [stage] Stage to be used-p, --port [port] Port for server to use (default: 8080)FAQs
🏇 A CLI tool for local development of google cloud functions
We found that coppa demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.