
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@walkeros/cli
Advanced tools
Command-line tools for building, testing, and running walkerOS event collection flows.
The walkerOS CLI is a developer tool that:
push --simulate)Think of it as your development toolchain for walkerOS - from config to running production bundles.
The CLI is for Bundled mode — when you want config-as-code and separate deployment:
| Use CLI When | Use Integrated Mode When |
|---|---|
| Static sites, landing pages | React/Next.js apps |
| Docker/server deployments | TypeScript projects |
| CI/CD versioned configs | Programmatic control |
| Marketing/GTM workflows | Build-time type safety |
For Integrated mode (importing directly into your app), see the Collector package.
# Global (recommended for CLI usage)
npm install -g @walkeros/cli
# Local (for programmatic usage)
npm install @walkeros/cli
# Bundle a flow configuration
walkeros bundle flow.json
# Test with simulated events (no real API calls)
walkeros push flow.json --event '{"name":"product view"}' --simulate destination.demo
# Push real events to destinations
walkeros push flow.json --event '{"name":"product view"}'
# Run a collection server locally
walkeros run dist/bundle.mjs --port 3000
Generate optimized JavaScript bundles from flow configurations.
walkeros bundle <config-file> [options]
Config files can be local paths or HTTP(S) URLs:
walkeros bundle ./config.json # Local file
walkeros bundle https://example.com/config.json # Remote URL
Options:
--flow <name> - Flow name for multi-flow configs--all - Build all flows for multi-flow configs--stats - Show bundle statistics--json - Output as JSON (implies --stats)--no-cache - Disable package caching--dockerfile [file] - Generate Dockerfile (or copy custom file) to dist/-v, --verbose - Verbose output-s, --silent - Suppress outputExamples:
# Bundle with stats
walkeros bundle examples/server-collect.json --stats
# Bundle with auto-generated Dockerfile
walkeros bundle flow.json --dockerfile
# Bundle with custom Dockerfile
walkeros bundle flow.json --dockerfile Dockerfile.custom
The output path uses convention-based defaults: ./dist/bundle.mjs for server,
./dist/walker.js for web.
Execute your flow with real API calls, or simulate specific steps with
--simulate. Accepts either a config JSON (which gets bundled) or a pre-built
bundle.
walkeros push <input> --event '<json>' [options]
Input types:
.js/.mjs) - Executed directlyThe CLI auto-detects the input type by attempting to parse as JSON.
Options:
-e, --event <source> - Event to push (JSON string, file path, or URL)
Required (unless simulating a source)--flow <name> - Flow name (for multi-flow configs)-p, --platform <platform> - Platform override (web or server)--simulate <step> - Simulate a step (repeatable). Mocks the step's push,
captures result. Use destination.NAME or source.NAME.--mock <step=value> - Mock a step with a specific return value (repeatable).
Use destination.NAME=VALUE.--snapshot <source> - JS file to eval before execution. Sets global state
(window.dataLayer, process.env, etc.).--json - Output results as JSON-v, --verbose - Verbose output-s, --silent - Suppress output (for CI/CD)Event input formats:
# Inline JSON
walkeros push flow.json --event '{"name":"page view","data":{"title":"Home"}}'
# File path
walkeros push flow.json --event ./events/order.json
# URL
walkeros push flow.json --event https://example.com/sample-event.json
Simulation examples:
# Simulate a destination (mock its push, capture API calls)
walkeros push flow.json -e event.json --simulate destination.ga4
# Simulate a source (capture events, disable all destinations)
walkeros push flow.json --simulate source.browser
# Mock a destination with a specific return value
walkeros push flow.json -e event.json --mock destination.ga4='{"status":"ok"}'
Bundle input:
# Push with pre-built bundle
walkeros push dist/bundle.mjs --event '{"name":"order complete"}'
# Override platform detection
walkeros push dist/bundle.js --platform server --event '{"name":"order complete"}'
Push modes:
| Mode | Flag | API Calls | Use Case |
|---|---|---|---|
| Real | (none) | Real HTTP requests | Integration testing |
| Simulate | --simulate | Mocked (captured) | Safe local testing |
| Mock | --mock | Returns mock value | Controlled testing |
Use --simulate first to validate safely, then push without flags for real
integrations.
Run flows locally (no Docker daemon required).
walkeros run <config-file> [options]
Options:
-p, --port <number> - Server port-h, --host <host> - Server host--json - Output as JSON-v, --verbose - Verbose output-s, --silent - Suppress outputExamples:
# Run collection server (auto-bundles JSON)
walkeros run examples/server-collect.json --port 3000
# Run with pre-built bundle
walkeros run examples/server-collect.mjs --port 3000
How it works:
.mjs.mjs bundles are used directlyValidate flow configurations, events, mappings, or contracts.
walkeros validate <config-file> [options]
By default, validates a Flow.Config file — checking schema, references, and cross-step example compatibility.
Options:
--type <type> - Validation type (default: flow). Also accepts: event,
mapping, contract--path <path> - Validate a specific entry against its package schema (e.g.,
destinations.snowplow, sources.browser)--flow <name> - Flow name for multi-flow configs--strict - Treat warnings as errors--json - Output as JSON-v, --verbose - Verbose output-s, --silent - Suppress outputExit codes: 0 = valid, 1 = errors, 2 = warnings (with --strict), 3 =
input error
Examples:
# Validate flow config (schema + examples)
walkeros validate flow.json
# Validate specific flow
walkeros validate flow.json --flow analytics
# Validate a single event
walkeros validate event.json --type event
# Validate in CI
walkeros validate flow.json --json --strict || exit 1
# Validate entry against package schema
walkeros validate flow.json --path destinations.snowplow
Deploy flows to walkerOS cloud.
walkeros deploy start <flowId> [options]
walkeros deploy status <flowId> [options]
Options:
--project <id> - Project ID (defaults to WALKEROS_PROJECT_ID)--flow <name> - Flow name for multi-config flows--no-wait - Do not wait for deployment to complete (start only)--json - Output as JSON-v, --verbose - Verbose output-s, --silent - Suppress outputExamples:
# Deploy a single-config flow
walkeros deploy start cfg_abc123
# Deploy a specific config from a multi-config flow
walkeros deploy start cfg_abc123 --flow web
# Check deployment status
walkeros deploy status cfg_abc123 --flow server
When a flow has multiple configs, the CLI requires --flow <name> to specify
which one to deploy. If omitted, the error message lists available names.
The CLI implements intelligent caching for faster builds:
.tmp/cache/packages/latest, ^, ~) are re-checked daily0.4.1) are cached indefinitely.tmp/cache/builds/# View cache info
walkeros cache info
# Clear all caches
walkeros cache clear
# Clear only package cache
walkeros cache clear --packages
# Clear only build cache
walkeros cache clear --builds
# Disable caching for a single build
walkeros bundle flow.json --no-cache
Flow configs use the Flow.Config format with version and flows:
{
"version": 3,
"flows": {
"default": {
"server": {},
"packages": {
"@walkeros/collector": { "imports": ["startFlow"] },
"@walkeros/server-source-express": {},
"@walkeros/destination-demo": {}
},
"sources": {
"http": {
"package": "@walkeros/server-source-express",
"config": {
"settings": { "path": "/collect", "port": 8080 }
}
}
},
"destinations": {
"demo": {
"package": "@walkeros/destination-demo",
"config": {
"settings": { "name": "Demo" }
}
}
},
"collector": { "run": true }
}
}
}
Platform is determined by the web: {} or server: {} key presence.
The CLI automatically resolves imports based on how you configure packages:
1. Default exports (recommended for single-export packages):
{
"packages": {
"@walkeros/server-destination-api": {}
},
"destinations": {
"api": {
"package": "@walkeros/server-destination-api"
}
}
}
The CLI generates:
import _walkerosServerDestinationApi from '@walkeros/server-destination-api';
2. Named exports (for multi-export packages):
{
"packages": {
"@walkeros/server-destination-gcp": {}
},
"destinations": {
"bigquery": {
"package": "@walkeros/server-destination-gcp",
"code": "destinationBigQuery"
},
"analytics": {
"package": "@walkeros/server-destination-gcp",
"code": "destinationAnalytics"
}
}
}
The CLI generates:
import { destinationBigQuery, destinationAnalytics } from '@walkeros/server-destination-gcp';
3. Utility imports (for helper functions):
{
"packages": {
"lodash": { "imports": ["get", "set"] }
},
"mappings": {
"custom": {
"data": "({ data }) => get(data, 'user.email')"
}
}
}
The CLI generates: import { get, set } from 'lodash';
Key points:
packages.imports for destinations/sources - the default export is used
automaticallycode when using a specific named export from a multi-export
packagepackages.imports only for utilities needed in mappings or custom codeUse local packages instead of npm for development or testing unpublished packages:
{
"packages": {
"@walkeros/collector": {
"path": "../packages/collector",
"imports": ["startFlow"]
},
"@my/custom-destination": {
"path": "./my-destination",
"imports": ["myDestination"]
}
}
}
Resolution rules:
path takes precedence over versiondist/ folder exists, it's used; otherwise package root is usedDependency resolution:
When a local package has dependencies on other packages that are also specified with local paths, the CLI will use the local versions for those dependencies too. This prevents npm versions from overwriting your local packages.
{
"packages": {
"@walkeros/core": {
"path": "../packages/core",
"imports": []
},
"@walkeros/collector": {
"path": "../packages/collector",
"imports": ["startFlow"]
}
}
}
In this example, even though @walkeros/collector depends on @walkeros/core,
the local version of core will be used (not downloaded from npm).
See examples/ for complete working configurations.
Use commands programmatically:
import { bundle, push, runCommand } from '@walkeros/cli';
// Bundle
await bundle({
config: './flow.json',
stats: true,
});
// Push with simulation
const result = await push(
'./flow.json',
{ name: 'page view', data: { title: 'Test' } },
{ simulate: ['destination.ga4'], json: true },
);
// result.usage = API call tracking data
// Push for real
await push(
'./flow.json',
{ name: 'page view', data: { title: 'Test' } },
);
// Run
await runCommand({
config: './flow.json',
port: 3000,
verbose: true,
});
Working example configs in examples/:
Try them:
# Bundle example
walkeros bundle examples/server-collect.json --stats
# Simulate
walkeros push \
examples/web-serve.json \
--event '{"name":"product view","data":{"id":"P123"}}' \
--simulate destination.demo
# Run server
walkeros run examples/server-collect.json --port 3000
Typical development cycle:
# 1. Create/edit config
vim my-flow.json
# 2. Test with simulation (no real API calls)
walkeros push \
my-flow.json \
--event '{"name":"product view"}' \
--simulate destination.demo \
--verbose
# 3. Bundle and check stats
walkeros bundle my-flow.json --stats
# 4. Run locally
walkeros run dist/bundle.mjs --port 3000
# 5. In another terminal, test it
curl -X POST http://localhost:3000/collect \
-H "Content-Type: application/json" \
-d '{"name":"page view","data":{"title":"Home"}}'
CLI (downloads packages + bundles with esbuild)
├─ Bundle → optimized .mjs file
├─ Push → execute bundle (with optional --simulate for testing)
└─ Run → execute bundle with built-in runtime
Key principle: CLI handles both build-time and runtime operations.
The walkeros/flow Docker image is a self-bundling runner for production
deployment. It supports four deployment modes — from fully local to fully
managed — all using the same image and config format.
# Mode A: Local only — no signup, no API
docker run -v ./flow.json:/app/flow.json -e BUNDLE=/app/flow.json walkeros/flow
# Mode B: Local config + dashboard visibility
docker run -v ./flow.json:/app/flow.json \
-e BUNDLE=/app/flow.json \
-e WALKEROS_TOKEN=sk-walkeros-xxx \
-e PROJECT_ID=proj_xxx \
walkeros/flow
# Mode C: Remote config with hot-swap
docker run \
-e WALKEROS_TOKEN=sk-walkeros-xxx \
-e PROJECT_ID=proj_xxx \
-e FLOW_ID=flow_xxx \
walkeros/flow
Each step adds one env var. Same runner, same config, same bundle pipeline.
See the Runner documentation for the full reference (env vars, pipeline, caching, hot-swap, health checks, troubleshooting).
Run the bundle directly with the CLI:
# Build your flow
walkeros bundle flow.json
# Run in production
walkeros run dist/bundle.mjs --port 8080
This runs the flow in the current Node.js process, suitable for deployment on platforms like AWS Lambda, Google Cloud Run, or any Node.js hosting.
See src/types.ts for TypeScript interfaces.
MIT © elbwalker
FAQs
walkerOS CLI - Bundle and deploy walkerOS components
The npm package @walkeros/cli receives a total of 321 weekly downloads. As such, @walkeros/cli popularity was classified as not popular.
We found that @walkeros/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.