
Security Fundamentals
Turtles, Clams, and Cyber Threat Actors: Shell Usage
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
@dxatscale/browserforce
Advanced tools
sf plugin for browser automation
Unlike the Scratch Org Definition Configuration which can only be used on the creation of a scratch org (sfdx force:org:create -f config/scratch-def.json
),
the Browserforce Configuration allows to "shape" any org, (e.g. scratch org, sandbox or production org) with similar preferences and unofficial preferences that are not (yet) available in the Scratch Org Definition Configuration or as Metadata (sfdx browserforce:apply -f config/setup-admin-login-as-any.json -u myOrg@example.com
).
Further benefits:
apply
command only applies what's necessary and allows re-execution (concept similar to terraform)There are several different methods to install sfdx-browserforce-plugin
:
# as an sfdx plugin globally
sf plugins:install @dxatscale/browserforce
Depending on your choice of installation, you can find the browserforce
namespace:
# globally in the sfdx cli
sf browserforce --help
$ sf browserforce --help
browser automation
USAGE
$ sf browserforce:COMMAND
COMMANDS
browserforce:apply apply a plan from a definition file
browserforce:plan retrieve state and generate plan file
Both the browserforce:apply
and browserforce:plan
commands expect a config file and a target username or alias for the org.
To enable Setup -> Security Controls -> Login Access Policies -> Administrators Can Log in as Any User
, the config file (here: ./config/setup-admin-login-as-any.json
) should look like this:
{
"$schema": "https://raw.githubusercontent.com/amtrack/sfdx-browserforce-plugin/master/src/plugins/schema.json",
"settings": {
"security": {
"loginAccessPolicies": {
"administratorsCanLogInAsAnyUser": true
}
}
}
}
Tip: If you use Visual Studio Code, you can leverage tab completion to build the config (powered by the JSON Schema).
Next apply the config:
$ sfdx browserforce:apply -f ./config/setup-admin-login-as-any.json --targetusername myOrg@example.com
logging in... done
Applying definition file ./config/setup-admin-login-as-any.json to org myOrg@example.com
[Security] retrieving state... done
[Security] changing 'loginAccessPolicies' to '{"administratorsCanLogInAsAnyUser":true}'... done
logging out... done
See the JSON Schema for all supported settings.
Here is a full blown example showing most of the supported settings in action:
{
"$schema": "https://raw.githubusercontent.com/amtrack/sfdx-browserforce-plugin/master/src/plugins/schema.json",
"settings": {
"communities": { "enabled": true },
"customerPortal": { "enabled": true },
"deferSharingCalculation": {
"suspend": true
},
"highVelocitySalesSettings": {
"setUpAndEnable": true
},
"homePageLayouts": {
"homePageLayoutAssignments": [
{
"profile": "Standard User",
"layout": "Home Page Default"
},
{
"profile": "System Administrator",
"layout": "DE Default"
}
]
},
"picklists": {
"picklistValues": [
{
"metadataType": "StandardValueSet",
"metadataFullName": "LeadSource",
"value": "Partner",
"newValue": "Partner Referral"
},
{
"metadataType": "CustomField",
"metadataFullName": "Vehicle__c.Features__c",
"value": "CD",
"newValue": "Media",
"absent": true
},
{
"metadataType": "CustomField",
"metadataFullName": "Vehicle__c.Features__c",
"value": "CD",
"newValue": "AC",
"active": false
}
]
},
"recordTypes": { "deletions": [{ "fullName": "Vehicle__c.SUV" }] },
"salesforceToSalesforce": { "enabled": true },
"security": {
"loginAccessPolicies": { "administratorsCanLogInAsAnyUser": true },
"sharing": { "enableExternalSharingModel": true }
},
"companyInformation": {
"defaultCurrencyIsoCode": "English (Ireland) - EUR"
}
}
}
BROWSER_DEBUG
run in non-headless mode (default: false
)BROWSERFORCE_NAVIGATION_TIMEOUT_MS
: adjustable for slow internet connections (default: 90000
)BROWSERFORCE_RETRY_MAX_RETRIES
: number of retries on failures opening a page (default: 4
)BROWSERFORCE_RETRY_TIMEOUT_MS
: initial time between retries in exponential mode (default: 4000
)Please see CONTRIBUTING.md for getting started.
MIT © dxatscale
FAQs
sfdx plugin for browser automation
The npm package @dxatscale/browserforce receives a total of 0 weekly downloads. As such, @dxatscale/browserforce popularity was classified as not popular.
We found that @dxatscale/browserforce demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Security News
At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.
Product
We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.