@electron/fuses

@electron/fuses

Flip Electron Fuses and customize your packaged build of Electron

Usage

Via JavaScript

import { flipFuses, FuseVersion, FuseV1Options } from '@electron/fuses';

// Call this after your app has been packaged (all files in place) but
// before code signing. This fits naturally in an electron-builder
// `afterPack` hook or an electron-forge `postPackage`/`packageAfterCopy` hook.
await flipFuses(
  require('electron'), // Returns the path to the electron binary
  {
    version: FuseVersion.V1,
    [FuseV1Options.RunAsNode]: false, // Disables ELECTRON_RUN_AS_NODE
    [FuseV1Options.EnableCookieEncryption]: true, // Enables cookie encryption
    [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false, // Disables the NODE_OPTIONS environment variable
    [FuseV1Options.EnableNodeCliInspectArguments]: false, // Disables the --inspect and --inspect-brk family of CLI options
    [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true, // Enables validation of the app.asar archive on macOS
    [FuseV1Options.OnlyLoadAppFromAsar]: true, // Enforces that Electron will only load your app from "app.asar" instead of its normal search paths
    [FuseV1Options.LoadBrowserProcessSpecificV8Snapshot]: true, // Loads V8 Snapshot from `browser_v8_context_snapshot.bin` for the browser process
    [FuseV1Options.GrantFileProtocolExtraPrivileges]: true, // Grants the file protocol extra privileges
    [FuseV1Options.WasmTrapHandlers]: true, // Enables V8 signal handlers to trap Out of Bounds memory access from WebAssembly
  },
);

For full API usage, see the API documentation.

From the command line

$ npx @electron/fuses read --app /Applications/Foo.app
$ npx @electron/fuses write --app /Applications/Foo.app <...key=on/off>

Apple Silicon

For arm64 macOS builds of your app, you will need to pass resetAdHocDarwinSignature: true to the flipFuses method if you are not immediately codesigning your app after flipping the fuses. Otherwise, the app will refuse to launch with code signature validation errors. This is a security measure on Apple Silicon devices.

import { flipFuses, FuseVersion, FuseV1Options } from '@electron/fuses';

await flipFuses(
  require('electron'),
  {
    version: FuseVersion.V1,
    resetAdHocDarwinSignature: targetPlatform === 'darwin' && targetArch === 'arm64',
    [FuseV1Options.RunAsNode]: false,
  },
);

New Fuses

If you want to ensure you provide a config for new fuses when upgrading Electron major versions, you can set the strictlyRequireAllFuses option to true.

This will hard fail the build if you are on a version of @electron/fuses that doesn't have configuration options for every fuse in the Electron binary you are targeting or if you don't provide a configuration for a specific fuse present in the Electron binary you are targeting.

import { flipFuses, FuseVersion, FuseV1Options } from '@electron/fuses';

await flipFuses(
  require('electron'),
  {
    version: FuseVersion.V1,
    strictlyRequireAllFuses: true,
    [FuseV1Options.RunAsNode]: false,
  },
);

Similar packages

Other packages similar to @electron/fuses

electron-builder

A complete Electron application packaging and distribution tool. It has packaging configuration for Electron fuses, so fuse settings can be applied as part of a broader build workflow. Unlike a dedicated fuse utility, it also handles tasks such as creating installers and publishing builds.

@electron/packager

Packages an Electron app and provides build customization options, including fuse configuration in supported versions. It is a broader packaging tool rather than a focused API for changing fuses on an Electron executable.