
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
Control panel for local development. The local fleet is the apps and sites you keep, plus the ports they listen on.
Control panel for local development.
One control panel for the repos you choose. See which ones have uncommitted work, unpushed commits, unpublished versions, or dependents pinned to an old release. Then act from the same board: commit, push, publish, bump versions, update dependents, and start or stop dev servers. Every write opens a plan first and waits for you to confirm.
The controls depend on where you open it:
http://127.0.0.1:4321, on the machine that runs localhelm serve: every read and every write./deck, from a phone or any other device on your LAN or Tailscale: read-only. One tile per running app that has a LocalSlip claim and listens beyond 127.0.0.1. Tap to open, long-press to copy the link. No commit, publish, start, or stop. Write requests from anywhere but loopback get a 403.Start and stop need LocalSlip. The Sites tab needs a FilePress site. Both are optional. LocalSlip is the slip. LocalHelm is the wheel.
pnpm add -g localhelm
# or from a checkout:
pnpm install && pnpm build
# From the folder that contains your repos:
localhelm serve
Open http://127.0.0.1:4321. Click Add projects, scan that folder (. is where you ran serve), tick the ones you keep, and confirm. Nothing auto-enrolls.
The same actions exist on the CLI if you want them. scan, status, and deps only read. Other commands print a plan; --apply writes. publish, push, ship, and global need named ids. Never --force.
localhelm scan .
localhelm enroll ./my-cli ./my-lib --apply
localhelm status
localhelm serve --free-port # stop the named pid on that port, then serve
Menu Main / Demo (or localhelm serve --demo) is a sandbox fleet (localhelm.fleet.demo.json). Add and remove stay off the main file. Clear demo wipes only that sandbox. Commit, publish, push, and Land stay off.
localhelm serve opens the dashboard on port 4321. A global install runs the packaged board (SSR deps are bundled; no app/ needed). A checkout still uses Vite. Serve from the same tree as localhelm.fleet.json (or a child) or the board stays empty. If that port is already taken, serve names the pid and stops. Re-run with --free-port to stop it and bind. Never --force. Writes stay on loopback.
Skip folders with .localhelmignore at the workspace, or ~/.localhelm/ignore.
Requires Node 22+. License Apache-2.0. Site: localhelm.dev.
FAQs
Control panel for local development. The local fleet is the apps and sites you keep, plus the ports they listen on.
The npm package localhelm receives a total of 469 weekly downloads. As such, localhelm popularity was classified as not popular.
We found that localhelm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.