
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
@zuroku/cli
Advanced tools
Command-line publisher for zuroku — upload AI-generated graphic-recording HTML + assets to your zuroku instance.
Command-line publisher for zuroku — uploads an HTML page plus its image assets to a zuroku instance and returns a shareable URL.
Designed for AI agents (Claude Code, etc.) and humans who generate static graphic-recording / explainer pages and want a one-shot deploy step.
npm install -g @zuroku/cli
# or
pnpm add -g @zuroku/cli
Requires Node.js 20+.
The CLI defaults to the AIDD-managed instance at https://app.zuroku.masao.ai. Pass --base-url to point at a self-hosted instance.
# 1. Get an API key from your zuroku app's Web UI → Settings → API keys,
# then register it once (creates ~/.config/zuroku/config.json, mode 0600).
zuroku auth login --token zrk_live_xxx
# self-hosted instance:
# zuroku auth login --token zrk_live_xxx --base-url https://zuroku.example.com
# 2. Make sure your HTML references images as `<img src="img/foo.png">`.
# If your generator emits `images/...`, rewrite it first:
mkdir -p /tmp/zuroku-deploy
sed 's|images/|img/|g' /path/to/index.html > /tmp/zuroku-deploy/index.html
cp /path/to/images/*.png /tmp/zuroku-deploy/
cd /tmp/zuroku-deploy
zuroku publish ./index.html ./*.png --title "..." --no-compress
# stdout last line is the public URL.
| Command | Purpose |
|---|---|
zuroku auth login | Save the API token to ~/.config/zuroku/config.json (mode 0600). |
zuroku publish <html> <assets...> | Upload an HTML page and its referenced images. |
zuroku list | List the publishes owned by the current token. |
zuroku delete <slug> | Soft-delete a publish. |
zuroku config (get|set|unset) <key> | Read / write per-user CLI defaults (e.g. default-visibility). |
Run zuroku <command> --help for the full flag list.
<img src> must use the img/ relative prefix (e.g. <img src="img/foo.png">); served route is /p/:slug/img/:filename.--no-compress to keep filenames and bytes intact (you must then resize manually).The CLI parses the HTML and verifies that every <img src="img/..."> resolves to a positional asset argument, fail-fast with tagged error messages:
| Tag | Meaning |
|---|---|
[MISSING] | HTML references an image not in the asset list. |
[UNUSED] | Asset passed in but not referenced from HTML. |
[WRONG-PATH] | <img src> does not start with img/. |
Each publish has a visibility:
private — only the owner can view.curator — viewable by Discord members with the configured curator role.Order of precedence: CLI flag (--private > --visibility) → per-user config default-visibility → server default (curator).
# Per-user default
zuroku config set default-visibility private
zuroku config unset default-visibility # back to server default
zuroku config get # show current settings
public is reserved by the server and rejected by both CLI and API. To make something publicly visible, publish as curator and toggle visibility from the web UI.
zuroku publish writes the bare URL as the last line of stdout. Progress, info, and success messages go to stderr.
URL=$(zuroku publish ./index.html ./img/*.png --title "..." 2>/dev/null | tail -1)
A ready-to-use Claude Code skill ships under skills/zuroku-publish/SKILL.md. Copy it into your project's .claude/skills/ to let Claude Code drive this CLI directly.
MIT — see LICENSE.
FAQs
Command-line publisher for zuroku — upload AI-generated graphic-recording HTML + assets to your zuroku instance.
The npm package @zuroku/cli receives a total of 6 weekly downloads. As such, @zuroku/cli popularity was classified as not popular.
We found that @zuroku/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.