
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Oni is a HTML/CSS/JavaScript interactive mask or "browser remote control" (inlcuding a front-end that works just like a browser). And it is fully programmable, and you can deliver it as a web app. So you get a browser within a browser, basically. It connects to a browser you run locally or in the cloud via DevTools. The connected browser can be headless or not. Oni don't care.
This means you can customize the browsing experience however you like, without having to fork it or modify its source code. You can even run supreme-architect remotely in the cloud against a headless browser and connect to it from anywhere. Or you can run it on your device. More than that you can build atop the Browser in ways that you can't using WebExtension APIs or with the DevTools protocol.
Things that aren't normally possible, become possible.
Watch the 16 second video, or just watch the GIF below:

Oni can be used as a simple remote browser isolation application.
If you want a hosted or managed on-prem cloud-based internet isolation solution, check out my corporate page at https://browsergap.xyz
Coming here from Awesome Chrome DevTools? Take a look at the "Zombie Lord" connection and "Translate Voodoo CRDP" for the two files with the largest concentrations of CRDTP code.
Install from npm
npm i supreme-architect
Or clone and download the repository.
Then run setup_machine.sh in the repository directory.
You can self-host on your own machine (at home, or in a VPS, VPC or the public cloud)
You can run the browser you connect to in headless mode or normal mode.
sudo apt update && sudo apt -y upgrade
sudo apt install -y curl git wget
git clone https://github.com/dosyago/supreme-architect
cd supreme-architect
./setup_machine.sh
npm test
Or (using docker build yourself)
sudo apt update && sudo apt -y upgrade
sudo apt install -y curl git wget
git clone https://github.com/dosyago/supreme-architect
cd supreme-architect
./buld_docker.sh
./run_docker.sh
Or (using docker pull from hub)
docker pull dosyago/browsergapce:1.0
curl -o chrome.json https://raw.githubusercontent.com/dosyago/supreme-architect/master/chrome.json
sudo su -c "echo 'kernel.unprivileged_userns_clone=1' > /etc/sysctl.d/00-local-userns.conf"
sudo su -c "echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/01-network-ipv4.conf"
sudo sysctl -p
sudo docker run -d -p 8002:8002 --security-opt seccomp=$(pwd)/chrome.json browsergapce:1.0
And visit http://<your ip>:8002 to see it up.
Or
Try for free at https://free.cloudbrowser.xyz
Or https://hk.cloudbrowser.xyz (if you're in Asia-Pac this is probably faster)
An annotated transcript of an install is available at this gist.
Tested using latest Stable Node.JS and Git using Git bash. Clone as normal then run npm i then ./postinstall.sh then modify ./zombie-lord/start_chrome.sh to comment out and uncomment the lines preceeded by a # windows ... comment, as those lines indicate.
Then run node index.js 5002 8002 xxxcookie username token2
If you want you can also modify zombie-lord/screenShots.js to increase the quality and framerate of shots taken if you're running locally.
In no particular order:
Just connect your browser to http://localhost:5002 from the machine you run it on.
Just run PPTR on the same machine as this and connect to localhost:5002
v1.1.0
FAQs
A browser in the browser
We found that onibrowser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.