
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
Agent-first CLI and skill for native iOS Simulator build, run, and proof loops.
iosctl is intentionally boring: it wraps first-party Apple command-line tools and a small number of proven adjacent tools behind stable JSON, explicit artifacts, and predictable failures.
Current status: Phase 2 proof and UI spine. The CLI includes environment checks, Simulator inventory, proof-run for build/install/launch/screenshot/receipts, and semantic UI snapshot/find/tap/type/swipe commands backed by idb.
Agents need a reliable way to prove iOS app behavior without depending on long-running MCP helper servers as the source of truth.
Design stance:
After the first npm release:
npm i -g iosctl
iosctl --help
Local:
npm install
npm run build
npm link
iosctl doctor --json
xcodebuild.xcrun simctl.xcrun xcresulttool.idb and idb_companion.xcbeautify, Maestro, XcodeBuildMCP.Implemented:
iosctl doctor --json
iosctl devices --json
iosctl proof-run --project App.xcodeproj --scheme App --bundle com.example.app --device "iPhone 17 Pro" --json
iosctl proof-run --workspace App.xcworkspace --scheme App --bundle com.example.app --runtime "iOS 26" --json
iosctl ui snapshot --device <UDID> --json
iosctl ui find --text "Book appointment" --json
iosctl ui tap --text "Book appointment" --json
iosctl ui type --text-field "Ask anything..." --value "Can I schedule a visit?" --json
iosctl ui swipe --direction up --json
iosctl contract --json
Planned:
iosctl project inspect --project App.xcodeproj --json
iosctl sim ensure --device "iPhone 17 Pro" --runtime "iOS 26" --json
iosctl build --project App.xcodeproj --scheme App --device "iPhone 17 Pro" --json
iosctl install --app ./App.app --device <UDID> --json
iosctl launch --bundle com.example.app --device <UDID> --env-file .env.local --json
proof-run writes artifacts under .iosctl/runs/<run-id>/ by default:
receipt.jsonsummary.mdbuild.logapp.logscreenshot-<name>.pngDerivedData/xcodebuild.xcresultui snapshot writes raw accessibility evidence under .iosctl/ui/<snapshot-id>/:
ui-tree.jsonelements.json--json, stdout is exactly one JSON object.0: success.1: operation failed.2: invalid input or missing local capability.3: safety refusal.See docs/CONTRACT_V1.md.
iosctl follows the Vercel skills CLI package layout: the installable skill lives at
skills/iosctl/SKILL.md, and there is intentionally no root SKILL.md to shadow nested skill
discovery.
List the skill:
npx -y skills add danielgwilson/iosctl --list
Install the skill:
npx -y skills add -g danielgwilson/iosctl --skill iosctl
Use the skill without installing:
npx -y skills use danielgwilson/iosctl@iosctl
Canonical skill path: skills/iosctl/SKILL.md.
This package is scaffolded for npm Trusted Publishing from GitHub Actions.
.github/workflows/ci.yml.github/workflows/publish.ymlnpm run lint:public-surfaceFAQs
Agent-first CLI and skill for native iOS Simulator build, run, and proof loops
The npm package iosctl receives a total of 4 weekly downloads. As such, iosctl popularity was classified as not popular.
We found that iosctl demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.