
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@moxxy/web-plugin
Advanced tools
Browser-based management dashboard for the Moxxy self-hosted multi-agent AI framework.
Documentation · Website · GitHub
Runs as a Moxxy plugin, connecting to the gateway's REST API and SSE event stream. Provides a complete web interface for managing agents, monitoring events, and configuring your self-hosted Moxxy deployment.
moxxy plugin install @moxxy/web-plugin
# Start the dashboard
moxxy plugin start @moxxy/web-plugin
# Or use the interactive plugin menu
moxxy plugin
The dashboard opens at http://localhost:17900. Navigate to Settings to configure your gateway URL and API token if they aren't injected automatically.
Requires Node.js 22+ and npm.
git clone <repo>
cd web-plugin
npm install
npm run dev
The dev server starts on port 17900 with a proxy that forwards /v1/* requests to the gateway at localhost:3000.
npm run build
Produces a production bundle in dist/.
npm run plugin:start
Serves the built dist/ directory using a zero-dependency static server.
The plugin is a single-page application built with Ripple. At runtime it ships only pre-built static assets and a lightweight Node.js file server (serve.js) - no build tools or framework dependencies are required.
When started by the Moxxy CLI, the plugin receives environment variables (MOXXY_API_URL, MOXXY_TOKEN, PORT) and serves the dashboard on the allocated port. The dashboard communicates with the gateway entirely through its public REST API and SSE event stream.
Set automatically when launched via moxxy plugin start:
| Variable | Description |
|---|---|
MOXXY_API_URL | Gateway base URL (e.g. http://localhost:3000) |
MOXXY_TOKEN | API bearer token |
PORT | Port to serve the dashboard on |
MOXXY_PLUGIN_NAME | Plugin package name (@moxxy/web-plugin) |
MOXXY_PLUGIN_PORT | Allocated port (same as PORT) |
MOXXY_HOME | Moxxy data directory (default ~/.moxxy) |
VITE_MOXXY_API_URL | Gateway URL exposed to browser code during development |
VITE_MOXXY_TOKEN | API token exposed to browser code during development |
Dual-licensed under MIT or Apache 2.0 at your option.
FAQs
Unknown package
We found that @moxxy/web-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.