binding private webui to localhost

`npm start` opens at localhost:3000, however after creating a static build of the app and kicking off with `npx serve`, it's now listening on localhost:5000 **and** :5000.

I've exhausted my resources looking through configs but can't figure out where listen addresses are set. Looking at the serve help page, I'm able to change the listen port, but when started it still listens on the external interface, even when specifying `--listen tcp://localhost:3000`.

How can I bind webui to localhost only!?