
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
Agent-first CLI and skill for native iOS Simulator build, run, and proof loops.
iosctl is intentionally boring: it wraps first-party Apple command-line tools and a small number of proven adjacent tools behind stable JSON, explicit artifacts, and predictable failures.
Current status: Phase 2 proof and UI spine. The CLI includes environment checks, Simulator inventory, proof-run for build/install/launch/screenshot/receipts, and semantic UI snapshot/find/tap/type/swipe commands backed by idb.
Agents need a reliable way to prove iOS app behavior without depending on long-running MCP helper servers as the source of truth.
Design stance:
After the first npm release:
npm i -g iosctl
iosctl --help
Local:
npm install
npm run build
npm link
iosctl doctor --json
xcodebuild.xcrun simctl.xcrun xcresulttool.idb and idb_companion.xcbeautify, Maestro, XcodeBuildMCP.Implemented:
iosctl doctor --json
iosctl devices --json
iosctl proof-run --project App.xcodeproj --scheme App --bundle com.example.app --device "iPhone 17 Pro" --json
iosctl proof-run --workspace App.xcworkspace --scheme App --bundle com.example.app --runtime "iOS 26" --json
iosctl ui snapshot --device <UDID> --json
iosctl ui find --text "Book appointment" --json
iosctl ui tap --text "Book appointment" --json
iosctl ui type --text-field "Ask anything..." --value "Can I schedule a visit?" --json
iosctl ui swipe --direction up --json
iosctl contract --json
Planned:
iosctl project inspect --project App.xcodeproj --json
iosctl sim ensure --device "iPhone 17 Pro" --runtime "iOS 26" --json
iosctl build --project App.xcodeproj --scheme App --device "iPhone 17 Pro" --json
iosctl install --app ./App.app --device <UDID> --json
iosctl launch --bundle com.example.app --device <UDID> --env-file .env.local --json
proof-run writes artifacts under .iosctl/runs/<run-id>/ by default:
receipt.jsonsummary.mdbuild.logapp.logscreenshot-<name>.pngDerivedData/xcodebuild.xcresultui snapshot writes raw accessibility evidence under .iosctl/ui/<snapshot-id>/:
ui-tree.jsonelements.json--json, stdout is exactly one JSON object.0: success.1: operation failed.2: invalid input or missing local capability.3: safety refusal.See docs/CONTRACT_V1.md.
iosctl follows the Vercel skills CLI package layout: the installable skill lives at
skills/iosctl/SKILL.md, and there is intentionally no root SKILL.md to shadow nested skill
discovery.
List the skill:
npx -y skills add danielgwilson/iosctl --list
Install the skill:
npx -y skills add -g danielgwilson/iosctl --skill iosctl
Use the skill without installing:
npx -y skills use danielgwilson/iosctl@iosctl
Canonical skill path: skills/iosctl/SKILL.md.
This package is scaffolded for npm Trusted Publishing from GitHub Actions.
.github/workflows/ci.yml.github/workflows/publish.ymlnpm run lint:public-surfaceFAQs
Agent-first CLI and skill for native iOS Simulator build, run, and proof loops
The npm package iosctl receives a total of 5 weekly downloads. As such, iosctl popularity was classified as not popular.
We found that iosctl demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.