
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
shell-mirror
Advanced tools
Access your Mac shell from any device securely. Perfect for mobile coding with Claude Code CLI, Gemini CLI, and any shell tool.
Access your Mac terminal from any device, securely. Perfect for mobile coding with Claude Code CLI, Gemini CLI, and any shell tool.
Shell Mirror lets you access your Mac terminal from any web browser on any device (phone, tablet, laptop). It uses WebRTC for fast, peer-to-peer terminal mirroring with Google OAuth 2.0 authentication to keep your terminal secure.
✅ Secure Access - Google OAuth 2.0 authentication
✅ WebRTC Connection - Fast, direct peer-to-peer terminal mirroring
✅ Multiple Sessions - Create and manage multiple terminal sessions
✅ Dashboard - Visual dashboard to manage connected agents and sessions
✅ Mobile-Friendly - Optimized for mobile coding (perfect for AI coding tools)
✅ NPM Package - Easy installation via npm install -g shell-mirror
✅ Auto-Start - Mac agent auto-starts and registers with cloud server
┌─────────────────────────────────────────────────────────────┐
│ User's Browser │
│ (https://shellmirror.app) │
│ ┌──────────────────────────────────────┐ │
│ │ Dashboard │ Terminal Interface │ │
│ └──────────────────────────────────────┘ │
└────────────────────┬────────────────────────────────────────┘
│
Google OAuth 2.0 Authentication
│
┌────────────────▼────────────────────────────┐
│ Heroku WebSocket Signaling Server │
│ (wss://shell-mirror-[...].herokuapp.com) │
│ │
│ • WebRTC signaling (SDP/ICE exchange) │
│ • Agent discovery & registration │
│ • Dashboard real-time updates │
└────────────────┬────────────────────────────┘
│
WebSocket Connection (both ways)
│
┌────────────────▼────────────────────────────┐
│ Mac Agent (User's Computer) │
│ │
│ • Auto-starts on login │
│ • Registers with cloud server │
│ • Manages multiple terminal sessions │
│ • WebRTC peer connection to browser │
└─────────────────────────────────────────────┘
│
Terminal Sessions
│
┌──────┴──────┐
│ Terminal │
│ (node-pty) │
└─────────────┘
# Install globally
npm install -g shell-mirror
# Run setup wizard (configures Google OAuth)
shell-mirror setup
# Start the agent
shell-mirror start
# Access from browser
# Visit: https://shellmirror.app
# Clone repository
git clone https://github.com/karmalsky/shell-mirror.git
cd terminal-mirror
# Install dependencies
npm install
# Configure environment
cp .env.example .env
# Edit .env with your Google OAuth credentials
# Start local WebSocket server
npm start
# Access at http://localhost:3000
Shell Mirror requires Google OAuth 2.0 credentials:
https://shellmirror.apphttps://shellmirror.app/auth/google/callback.env file or provide during shell-mirror setupFor detailed OAuth setup instructions, see the old README in old_md/README_old.md (lines 66-98).
shell-mirror start # Start agent
shell-mirror stop # Stop agent
shell-mirror restart # Restart agent
shell-mirror status # Check status
shell-mirror setup # Run setup wizard
terminal-mirror/
├── server.js # WebSocket signaling server
├── auth.js # Google OAuth configuration
├── lib/ # CLI and agent management
│ ├── auto-start.js # Mac agent auto-start logic
│ ├── setup-wizard.js # Interactive setup
│ └── ...
├── mac-agent/ # Mac terminal mirroring agent
│ ├── agent.js # Main agent (WebRTC + sessions)
│ └── http-agent.js # HTTP polling fallback
├── public/ # Frontend files
│ ├── index.html # Landing page
│ └── app/ # Dashboard and terminal UI
├── heroku/ # Heroku WebSocket server deployment
└── php-backend/ # PHP APIs for agent registration
# Deploy WebSocket server to Heroku
./deploy-heroku.sh
# Deploy website/PHP backend to TMDHosting
node deploy-php.cjs
# Publish NPM package (user must run manually per CLAUDE.md)
./publish.sh
For detailed deployment instructions, see DEPLOYMENT-PUBLISHING-GUIDE.md.
./status.sh # Check all services
# Heroku WebSocket server
heroku logs --tail -a shell-mirror
# PHP backend (web)
https://shellmirror.app/debug.html
# Local logs
tail -f server-debug.log
For complete operations guide, see OPERATIONS.md.
Shell Mirror supports multiple persistent terminal sessions per user:
mac-agent/agent.js (line 158)Current Version: 1.5.74
# Install
npm install -g shell-mirror
# Usage
shell-mirror --help
Package includes:
# Check agent status
shell-mirror status
# View logs
tail -f ~/.shell-mirror/agent.log
# Restart agent
shell-mirror restart
# Check server health
curl https://shell-mirror-30aa5479ceaf.herokuapp.com/health
# View Heroku logs
heroku logs --tail -a shell-mirror
For detailed troubleshooting, see OPERATIONS.md.
This is currently a personal project. For bug reports or feature requests, please check the GitHub issues.
MIT
Last Updated: 2025-01-26 Version: 1.5.74
FAQs
Access your Mac shell from any device securely. Perfect for mobile coding with Claude Code CLI, Gemini CLI, and any shell tool.
The npm package shell-mirror receives a total of 208 weekly downloads. As such, shell-mirror popularity was classified as not popular.
We found that shell-mirror demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.