
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@onkernel/create-kernel-app
Advanced tools
A CLI tool to create the scaffolding for a new Kernel applications. This tool helps you get started with building browser automation applications using Kernel's platform.
npx @onkernel/create-kernel-app
Create a new Kernel application by running:
create-kernel-app [app-name] [options]
-l, --language <language>: Choose your programming language
typescript or tspython or py-t, --template <template>: Select a template
sample-app: Basic template with Playwright integrationbrowser-use: Template with Browser Use SDK (Python only)stagehand: Template with Stagehand SDK (Typescript only)advanced-sample: Implements sample apps using advanced Kernel configscomputer-use: Implements a prompt loop using Anthropic Computer Usecua: Implements a Computer Use Agent (OpenAI CUA) sampleCreate a TypeScript application with a sample app:
npx @onkernel/create-kernel-app my-app --language typescript --template sample-app
Create a Typescript application with Stagehand template:
npx @onkernel/create-kernel-app my-app --language typescript --template stagehand
Create a Typescript application with Computer Use template:
npx @onkernel/create-kernel-app my-app --language typescript --template computer-use
Create a Python application with a sample app:
npx @onkernel/create-kernel-app my-app --language python --template sample-app
Create a Python application with Browser Use template:
npx @onkernel/create-kernel-app my-app --language python --template browser-use
## Next Steps
After creating your application:
1. Navigate to your project directory:
```bash
cd my-app
npm installuv venv && source .venv/bin/activate && uv synckernel login # or: export KERNEL_API_KEY=<YOUR_API_KEY>
# Typscript
kernel deploy index.ts # --env OPENAI_API_KEY=XXX if Stagehand; --env ANTHROPIC_API_KEY=XXX if Computer Use
# Python
kernel deploy main.py # --env OPENAI_API_KEY=XXX if Browser Use
If deploying an app that requires environment variables, make sure to set them when you deploy.
# Typescript + Sample App
kernel invoke ts-basic get-page-title --payload '{"url": "https://www.google.com"}'
# Typescript + Stagehand
kernel invoke ts-stagehand stagehand-task --payload '{"query": "Best wired earbuds"}'
# Typescript + Computer Use
kernel invoke ts-cu cu-task --payload '{"query": "Search for the top 3 restaurants in NYC according to Pete Wells"}'
# Python + Sample App
kernel invoke python-basic get-page-title --payload '{"url": "https://www.google.com"}'
# Python + Browser Use
kernel invoke python-bu bu-task --payload '{"task": "Compare the price of gpt-4o and DeepSeek-V3"}'
# Typescript + CUA Sample
kernel invoke ts-cua cua-task --payload '{"task": "Go to https://news.ycombinator.com and get the top 5 articles"}'
# Python + CUA Sample
kernel invoke python-cua cua-task --payload '{"task": "Get current market price range for an unboxed Dreamcast"}'
These are the sample apps currently available when you run npx @onkernel/create-kernel-app:
| Template | Description | Framework | Query Parameters |
|---|---|---|---|
| sample-app | Returns the page title of a specified URL | Playwright | { url } |
| browser-use | Completes a specified task | Browser Use | { task } |
| stagehand | Returns the first result of a specified Google search | Stagehand | { query } |
| advanced-sample | Implements sample apps using advanced Kernel configs | n/a | |
| computer-use | Implements a prompt loop | Anthropic Computer Use API | { query } |
| cua | Implements the OpenAI Computer Using Agent (CUA) | OpenAI CUA | { task } |
For more information about Kernel and its features, visit:
Contributions are welcome! Please feel free to submit a pull request. See Contributing and Code of Conduct
MIT © Kernel
FAQs
Create Kernel sample applications
We found that @onkernel/create-kernel-app demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.