
Research
/Security News
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
@omniterm/host
Advanced tools
omniterm — a generic, browser-based dev host: persistent terminals, a browser-view panel, workspace management, and a runtime plugin API. CLI: omniterm.
omniterm puts persistent terminal sessions, project files, and a live browser view in one web app.
Run it on the computer that holds your projects — a laptop, a home server, or a cloud VM with no desktop — then open it from a laptop, tablet, or phone. Your terminal sessions keep running when you close the browser or lose your connection.

tmux session that you
can also open over SSH.omniterm requires Node.js 24 or newer, tmux, and
ttyd. It runs on a server with no desktop. Add Chrome or Chromium if you want
the interactive remote browser.
Install tmux and ttyd:
# macOS
brew install tmux ttyd
# Ubuntu or Debian
sudo apt install tmux
sudo snap install ttyd --classic
Install omniterm and start it:
npm install -g @omniterm/host
omniterm
Then open http://localhost:17717.
The npm package is named @omniterm/host, but the command is omniterm. You
can also run it without installing it globally — name the package with -p and
the command after it, since the package ships more than one binary:
npx -p @omniterm/host omniterm
Use a different web server port:
omniterm --port 8080
omniterm uses ports 7700 through 7799 for terminal sessions. If another program uses those ports, choose a different range:
omniterm --ttyd-ports 8800-8899
Run omniterm --help to see every command-line option.
tmux sessions that were started outside omniterm.When something in your terminal opens a URL — a sign-in flow, a coding agent — Chrome starts on the server and appears in omniterm as a live view.

[!WARNING] By default, omniterm listens on all network interfaces. It does not provide its own login or access control, and its APIs can start commands in your shell. Do not expose its port directly to the public internet. Use a trusted private network, VPN, or SSH tunnel.
For an SSH tunnel, bind omniterm to the remote computer's loopback address:
omniterm --host 127.0.0.1
Then run this on your local computer:
ssh -L 17717:localhost:17717 your-server
Open http://localhost:17717 while the tunnel is running.
You can also open http://your-server.tailnet:17717 through a private network
such as Tailscale.
Make sure your firewall or network rules allow access only from devices you trust.
Plugins add features without changing the main app. Load a published npm package by name, or load a local plugin by the path to its built entry file:
omniterm --plugin @scope/my-plugin
omniterm --plugin ./plugins/demo-agent/dist/index.js
To load more than one plugin, repeat the --plugin option. omniterm loads them
in the order you provide them.
A local path must point to the plugin's built JavaScript entry file, not just its directory.
To write a plugin, install
@omniterm/plugin-types
as a development dependency. Your plugin does not need to depend on omniterm's
internal code. See the
demo-agent plugin
for a complete example.
The official npm package collects pseudonymous usage and performance data to help improve omniterm. A random installation ID connects events from one installation. The ID does not come from an account, username, hostname, or machine identifier.
Events may include:
Events do not include names, file or terminal contents, file paths, repository names, hostnames, session names, or third-party plugin identifiers. omniterm disables PostHog's GeoIP enrichment. PostHog still receives the network data needed to deliver an event; see PostHog's privacy policy for its handling and retention rules.
Telemetry is on by default in the official npm package and off in automated environments. You can turn it off in any of these ways:
omniterm telemetry off # Save the setting
omniterm telemetry status # Show the current setting
omniterm --no-telemetry # Turn it off for one run
export OMNITERM_TELEMETRY=0 # omniterm-specific environment setting
export DO_NOT_TRACK=1 # Standard environment setting
You can also turn it off in Settings → Privacy → Telemetry. Environment
settings override the saved choice. Local performance measurements remain
available at GET /api/metrics/perf, even when telemetry is off, but nothing is
sent from your computer.
The PostHog key is added when the official npm package is built. It is not
stored in this repository, so a build from source does not send telemetry. To
use your own PostHog project in a source build, set OMNITERM_POSTHOG_KEY when
you run omniterm.
omniterm runs a Node.js web server on the computer where your projects live. The server connects the browser interface to standard command-line tools:
tmux keeps terminal sessions alive.ttyd displays those sessions in the browser.Because tmux owns the sessions, they are not locked inside omniterm. You can
use tmux attach over SSH, and terminal work continues if the omniterm process
stops.
See the
CONTRIBUTING.md
guide for development setup, repository structure, tests, and project
conventions.
FAQs
omniterm — a generic, browser-based dev host: persistent terminals, a browser-view panel, workspace management, and a runtime plugin API. CLI: omniterm.
We found that @omniterm/host demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.