
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
A CLI tool for configuration-driven management of long-running interactive applications.
A CLI tool for configuration-driven management of long-running interactive applications.
[!WARNING]
Itson is under development. It should not be considered suitable for general use until a 1.0 release.
Itson helps you install, update, and run your bespoke privately-distributed applications in the context of long-running interactive installations or exhibits.
Itson does the following each time it runs:
Read a configuration file and register any new configuration settings with the operating system.
For now, this amounts to scheduling itson's own launch on future startups.
Check for available updates to exhibit applications, prompting for credentials if necessary.
For now, this is limited to checking for new releases on GitHub, and follows semver rules. The latest release is selected by default, or a semver-compatible version constraint or range may be specified in the application's configuration. GitHub credentials are requested interactively as needed and securely stored for subsequent use.
Download and install updates if available.
For now, this means standalone pre-built .exe binaries or .app bundles provided as assets attached to GitHub releases, or uv tool-installable Python application packages hosted in GitHub repositories.
Upload log files.
For now, this means syncing a folder of log files to an S3-compatible object storage bucket for each application. S3 credentials are requested interactively as needed and then securely stored in the system keychain for subsequent use.
Start exhibit application(s) using the system-level services framework, and keep them running if they're closed or crash.
For now, this leverages launchd on macOS.
Itson is architected with future cross-platform support in mind, but currently only provides implementations for macOS.
Itson requires Node 22.12.0+.
Installing Python application packages requires uv.
npm install --global itson
Create a configuration file as described below, and then invoke itson to update the system to reflect your configuration, check for and install any application updates, and then immediately launch any specified applications.
This command runs automatically at system startup when runOnStartup: true in your configuration.
Create an itson.config.js file in your home directory.
export default {
applications: [
{
command: '/Applications/AllWork.app/Contents/MacOS/AllWork',
name: 'AllWork',
update: {
artifactPattern: /^AllWork.+\.zip$/,
destination: '/Applications/AllWork.app',
owner: 'kitschpatrol',
repo: 'allwork',
type: 'github',
},
},
{
command: 'interpose',
name: 'Interpose',
},
],
runOnStartup: true,
}
An optional update strategy may be specified.
Currently, only updates from GitHub releases containing Python application packages or attached binary artifacts are supported.
Private GitHub repositories are supported via personal access tokens bearing at least the contents:read and metadata:read permissions.
itsonRun an itson command.
If no command is provided, itson launch is run by default.
Usage:
itson [command]
| Command | Description |
|---|---|
launch | Update, register, and start all managed applications. Applications will auto-restart if they crash. (Default command.) |
start | Start all managed applications. Applications will auto-restart if they crash. |
stop | Stop all managed applications. |
update | Update all managed applications to the latest available versions. |
register | Register itson with the system according to the config file. Optionally run this after changing state in the config file. |
reset | Clear any credentials stored in the system keychain, and remove any registered services. |
| Option | Description | Type |
|---|---|---|
--verbose | Run with verbose logging | boolean |
--help-h | Show help | boolean |
--version-v | Show version number | boolean |
Update functionality can be baked into applications (e.g. Squirrel, Sparkle, Electron autoUpdater, etc.), but these are geared toward end-user applications and generally display their prompts interactively — unworkable for an "always up" interactive exhibit application.
Homebrew or Scoop implement robust and readily-scriptable package management solutions, but none are (practically) cross-platform. Securing and managing private registries for one-off applications is a bit of a pain.
Docker and other containerization strategies can be appealing on the back-end. For highly interactive real-time graphical applications, containerization creates extra hoops to jump through to access specialized low-level hardware, GPUs, and audio devices.
Itson is responsible for the following:
Itson is currently not concerned with the following:
Itson itself is not a long-running process. It runs once at startup, and then hands over responsibility for application monitoring to the operating system's native service-management facilities.
Native implementations are used wherever possible (e.g. launchd for process management, the system keychain for credential storage.)
~/Library/LaunchAgents//tmp/Issues and pull requests are welcome.
MIT © Eric Mika
FAQs
A CLI tool for configuration-driven management of long-running interactive applications.
The npm package itson receives a total of 0 weekly downloads. As such, itson popularity was classified as not popular.
We found that itson demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.

Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.

Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.