
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
[](https://github.com/sakhnyuk/emucli/actions) [](https://www.npmjs.com/package/emul)
emu)emu is a Bun + Effect-TS CLI for discovering, booting, and automating iOS simulators and Android emulators/devices.
It is designed for agent/LLM use:
@e1, @e2, …)--json outputbun install
bun run build
Run from source:
bun run dev -- --help
adbemulatorxcrun / simctlxcodebuild (used to launch the vendored XCTest runner)List devices:
emu devices list
emu devices list --platform ios
emu devices list --platform android --json
Boot:
emu boot <device-id> # UDID (iOS) or AVD name (Android)
Snapshot:
emu snapshot # single booted device will be used
emu snapshot --platform ios
emu snapshot --platform android --interactive # flat list of clickable elements
emu snapshot --platform ios --max-depth 4 --compact
emu snapshot --platform ios --debug-dir ./debug/snap1 --json
The --interactive flag returns a dramatically reduced flat list (~20-40 elements) of only clickable items (buttons, cells, named images). Refs like @e73 are consistent across modes, so you can use --interactive to find elements then tap --ref @e73 to interact.
Interact:
emu tap --platform ios --ref @e5
emu swipe --platform android --direction down --ref @e2
emu input --platform ios --ref @e3 --text "hello"
App lifecycle:
emu install --platform android --path app.apk
emu install --platform ios --path My.app
emu open --platform android --app com.example.app
emu open --platform ios --app com.example.app
--json contract--json is per-command (not global).--json mode:
tag + message + details)DOCUMENTATION.md — full feature reference and architectureAGENTS.md — conventions for AI agentsemu docs — token-efficient markdowndocs/EXIT_CODES.md — stable exit codes and JSON envelopeThis project uses semantic-release for automated versioning and publishing.
Ensure all changes use conventional commits:
feat: add new command → minor version bump (1.0.0 → 1.1.0)fix: resolve crash on startup → patch version bump (1.0.0 → 1.0.1)feat!: change CLI argument format → major version bump (1.0.0 → 2.0.0)feat: new feature\n\nBREAKING CHANGE: descriptionMerge changes to main branch
Trigger release:
semantic-release will:
<type>(<scope>): <subject>
<body>
<footer>
Types:
feat: New featurefix: Bug fixdocs: Documentation onlystyle: Code style changes (formatting, etc)refactor: Code refactoringperf: Performance improvementstest: Adding or updating testschore: Maintenance tasksExamples:
git commit -m "feat: add snapshot debug artifacts"
git commit -m "fix: resolve Android input encoding issue"
git commit -m "docs: update installation instructions"
git commit -m "feat!: change device ref format to platform:id"
bun test
bunx tsc --noEmit
By default, tests run without requiring any emulator/simulator tooling.
To run the opt-in integration suite against a real booted device:
EMUCLI_INTEGRATION=1 bun test test/integration.test.ts
Useful environment variables:
EMUCLI_INTEGRATION_PLATFORM=ios|android|all (default: all)EMUCLI_IOS_DEVICE=ios:<udid> (optional; otherwise uses active device resolution)EMUCLI_ANDROID_DEVICE=android:<serial> (optional)EMUCLI_IOS_INPUT_REF=@eN (optional; auto-discovery will try to find a usable Search/TextField)EMUCLI_IOS_SEARCH_QUERY=... (default: Search, used for auto-discovery)EMUCLI_ANDROID_INPUT_REF=@eN (optional)FAQs
[](https://github.com/sakhnyuk/emucli/actions) [](https://www.npmjs.com/package/emul)
We found that emul demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.