
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
ghost-cursor-frames
Advanced tools
Move your mouse like a human in puppeteer or generate realistic movements on any 2D plane, this version has support for iframes
Generate realistic, human-like mouse movement data between coordinates or navigate between elements with puppeteer like the definitely-not-robot you are.
Oh yeah? Could a robot do this?
yarn add ghost-cursor-frames
or with npm
npm install ghost-cursor-frames
Generating movement data between 2 coordinates.
import { path } from "ghost-cursor-frames"
const from = { x: 100, y: 100 }
const to = { x: 600, y: 700 }
const route = path(from, to)
/**
* [
* { x: 100, y: 100 },
* { x: 108.75573501957051, y: 102.83608396351725 },
* { x: 117.54686481838543, y: 106.20019239793275 },
* { x: 126.3749821408895, y: 110.08364505509256 },
* { x: 135.24167973152743, y: 114.47776168684264 }
* ... and so on
* ]
*/
Usage with puppeteer:
import { createCursor } from "ghost-cursor-frames"
import puppeteer from "puppeteer"
const run = async (url) => {
const selector = "#sign-up button"
const browser = await puppeteer.launch({ headless: false });
const page = browser.newPage()
const cursor = createCursor(page)
await page.goto(url)
await page.waitForSelector(selector)
await cursor.click(selector)
// shorthand for
// await cursor.move(selector)
// await cursor.click()
}
Usage with iframes:
import { createCursor } from "ghost-cursor-frames"
import puppeteer from "puppeteer"
const run = async (url) => {
const selector = "#sign-up button"
const browser = await puppeteer.launch({ headless: false });
const page = browser.newPage()
const cursor = createCursor(page)
await page.goto(url)
await page.waitForSelector(selector)
const elementHandle = await page.$("frameSelector");
const frame = await elementHandle.contentFrame();
await cursor.click(selector, {}, frame)
}
cursor.move() will automatically overshoot or slightly miss and re-adjust for elements that are too far away
from the cursor's starting point.
Ghost cursor in action on a form
Bezier curves do almost all the work here. They let us create an infinite amount of curves between any 2 points we want and they look quite human-like. (At least moreso than alternatives like perlin or simplex noise)

The magic comes from being able to set multiple points for the curve to go through. This is done by picking 2 coordinates randomly in a limited area above and under the curve.
However, we don't want wonky looking cubic curves when using this method because nobody really moves their mouse that way, so only one side of the line is picked when generating random points.
When calculating how fast the mouse should be moving we use Fitts's Law
to determine the amount of points we should be returning relative to the width of the element being clicked on and the distance
between the mouse and the object.
This is a fork of Ghost Cursor with support for iframes
FAQs
Move your mouse like a human in puppeteer or generate realistic movements on any 2D plane, this version has support for iframes
The npm package ghost-cursor-frames receives a total of 14 weekly downloads. As such, ghost-cursor-frames popularity was classified as not popular.
We found that ghost-cursor-frames demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.