
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
@jackwener/opencli
Advanced tools
Make any website your CLI.
Zero risk · Reuse Chrome login · AI-powered discovery
A CLI tool that turns any website into a command-line interface. 28+ commands across 16 sites — bilibili, zhihu, xiaohongshu, twitter, reddit, github, v2ex, hackernews, bbc, weibo, boss, yahoo-finance, reuters, smzdm, ctrip, youtube — powered by browser session reuse and AI-native discovery.
explore discovers APIs, synthesize generates adapters, cascade finds auth strategiesnpm install -g @jackwener/opencli
Then use directly:
opencli list # See all commands
opencli hackernews top --limit 5 # Public API, no browser
opencli bilibili hot --limit 5 # Browser command
opencli zhihu hot -f json # JSON output
git clone git@github.com:jackwener/opencli.git
cd opencli && npm install
npx tsx src/main.ts list
# npm global
npm update -g @jackwener/opencli
# Or reinstall to latest
npm install -g @jackwener/opencli@latest
Browser commands need:
PLAYWRIGHT_MCP_EXTENSION_TOKEN (from the extension settings page) in your MCP config:{
"mcpServers": {
"playwright": {
"command": "npx",
"args": ["@playwright/mcp@latest", "--extension"],
"env": {
"PLAYWRIGHT_MCP_EXTENSION_TOKEN": "<your-token>"
}
}
}
}
Public API commands (hackernews, github search, v2ex) need no browser at all.
⚠️ Important: Browser commands reuse your Chrome login session. You must be logged into the target website in Chrome before running commands. If you get empty data or errors, check your login status first.
| Site | Commands | Mode |
|---|---|---|
| bilibili | hot search me favorite history feed user-videos | 🔐 Browser |
| zhihu | hot search question | 🔐 Browser |
| xiaohongshu | search notifications feed | 🔐 Browser |
trending | 🔐 Browser | |
hot | 🔐 Browser | |
hot | 🔐 Browser | |
| boss | search | 🔐 Browser |
| youtube | search | 🔐 Browser |
| yahoo-finance | quote | 🔐 Browser |
| reuters | search | 🔐 Browser |
| smzdm | search | 🔐 Browser |
| ctrip | search | 🔐 Browser |
| github | trending search | 🔐 / 🌐 |
| v2ex | hot latest topic | 🌐 Public |
| hackernews | top | 🌐 Public |
| bbc | news | 🌐 Public |
opencli bilibili hot -f table # Default: rich table
opencli bilibili hot -f json # JSON (pipe to jq, feed to AI)
opencli bilibili hot -f md # Markdown
opencli bilibili hot -f csv # CSV
opencli bilibili hot -v # Verbose: show pipeline steps
# 1. Deep Explore — discover APIs, infer capabilities, detect framework
opencli explore https://example.com --site mysite
# 2. Synthesize — generate YAML adapters from explore artifacts
opencli synthesize mysite
# 3. Generate — one-shot: explore → synthesize → register
opencli generate https://example.com --goal "hot"
# 4. Strategy Cascade — auto-probe: PUBLIC → COOKIE → HEADER
opencli cascade https://api.example.com/data
Explore outputs to .opencli/explore/<site>/:
manifest.json — site metadata, framework detectionendpoints.json — scored API endpoints with response schemascapabilities.json — inferred capabilities with confidence scoresauth.json — authentication strategy recommendationsSee SKILL.md for the full adapter guide (YAML pipeline + TypeScript).
# Bump version
npm version patch # 0.1.0 → 0.1.1
npm version minor # 0.1.0 → 0.2.0
npm version major # 0.1.0 → 1.0.0
# Push tag to trigger GitHub Actions auto-release
git push --follow-tags
The CI will automatically build, create a GitHub release, and publish to npm.
MIT
FAQs
Make any website or Electron App your CLI. AI-powered.
The npm package @jackwener/opencli receives a total of 10,628 weekly downloads. As such, @jackwener/opencli popularity was classified as popular.
We found that @jackwener/opencli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.