
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
A modernized fork of the original
spoofproject, updated for compatibility with modern macOS (Sequoia 15.4+, Tahoe 26+). Currently only macOS is fully supported. Modern Windows and Linux support is planned but not yet implemented.
A Node.js utility for changing MAC addresses and DHCPv6 DUIDs. Currently focused on reliable macOS support with Windows and Linux support coming soon.
This repository is a fork of the original spoof project, updated to work with modern macOS versions where Apple has removed the airport CLI tool and introduced new WiFi driver restrictions.
airport dependency: The deprecated airport -z command has been replaced with modern networksetup commandsnpm install -g spoofy
git clone https://github.com/basedbytes/spoofy.git
cd spoofy
npm install
npm install -g .
List network interfaces:
spoofy list
Randomize MAC address (WiFi is typically en0 on macOS):
sudo spoofy randomize en0
Note: WiFi will disconnect briefly and may need to reconnect to networks.
You can always see up-to-date usage instructions by running spoofy --help.
spoofy list
Output:
- "Ethernet" on device "en4" with MAC address 70:56:51:BE:B3:00
- "Wi-Fi" on device "en0" with MAC address 70:56:51:BE:B3:01 currently set to 70:56:51:BE:B3:02
- "Bluetooth PAN" on device "en1"
spoofy list --wifi
Using hardware port name:
sudo spoofy randomize wi-fi
Or using device name:
sudo spoofy randomize en0
sudo spoofy set 00:11:22:33:44:55 en0
sudo spoofy reset wi-fi
Note: On macOS, restarting your computer will also reset your MAC address to the original hardware address.
spoofy also supports DHCPv6 DUID (DHCP Unique Identifier) spoofing for complete IPv6 network identity management.
A DUID (DHCP Unique Identifier) is used in DHCPv6 to uniquely identify a client on IPv6 networks. Unlike MAC addresses which identify network interfaces, DUIDs identify DHCP clients across all interfaces and persist across reboots.
The first time you spoof your DUID, your original DUID is automatically saved to:
/var/db/dhcpclient/DUID.original/var/lib/spoofy/duid.original (planned)%PROGRAMDATA%\spoofy\duid.original (planned)This allows you to restore to your pre-spoofing state at any time using spoofy duid restore.
spoofy duid list
Generate and set a random DUID (automatically saves your original on first use):
sudo spoofy duid randomize en0
You can specify the DUID type:
sudo spoofy duid randomize en0 --type=LLT
sudo spoofy duid set 00:03:00:01:aa:bb:cc:dd:ee:ff en0
Match DUID to the current MAC address of an interface (useful after MAC spoofing):
sudo spoofy duid sync en0
With specific type:
sudo spoofy duid sync en0 --type=LLT
Typical workflow for complete identity spoofing:
sudo spoofy randomize en0 # Spoof MAC first
sudo spoofy duid sync en0 # Then sync DUID to match
This ensures both layers show the same spoofed identity on IPv6 networks.
Return to your original (pre-spoofing) DUID:
sudo spoofy duid restore en0
Delete current DUID and let the system generate a NEW random one:
sudo spoofy duid reset en0
Important: reset generates a NEW DUID, while restore returns to your ORIGINAL.
| Type | Name | Description |
|---|---|---|
| 1 | DUID-LLT | Link-layer address + timestamp (most common) |
| 2 | DUID-EN | Enterprise number + identifier |
| 3 | DUID-LL | Link-layer address only (default) |
| 4 | DUID-UUID | UUID-based identifier |
const spoofy = require('spoofy');
// Get current DUID
const current = spoofy.duid.getCurrentDUID();
console.log('Current DUID:', spoofy.duid.formatDUID(current));
// Parse DUID info
const info = spoofy.duid.parseDUID(current);
console.log('Type:', info.typeName);
console.log('MAC:', info.lladdr);
// Check if original is stored
if (spoofy.duid.hasOriginalDUID()) {
const original = spoofy.duid.getOriginalDUID();
console.log('Original DUID:', spoofy.duid.formatDUID(original));
}
// Generate a random DUID
const newDuid = spoofy.duid.generateDUID(spoofy.duid.DUID_TYPES.DUID_LL);
console.log('Generated:', spoofy.duid.formatDUID(newDuid));
// Set DUID (requires root) - automatically saves original on first call
spoofy.duid.setDUID(newDuid, 'en0');
// Randomize DUID
spoofy.duid.randomizeDUID(spoofy.duid.DUID_TYPES.DUID_LLT, 'en0');
// Sync DUID to current MAC address
spoofy.duid.syncDUID('en0', spoofy.duid.DUID_TYPES.DUID_LL);
// Restore to original DUID
spoofy.duid.restoreDUID('en0');
For complete identity change on IPv6 networks, you should change both MAC and DUID.
Recommended workflow using sync:
sudo spoofy randomize en0 # Spoof MAC first
sudo spoofy duid sync en0 # Sync DUID to match spoofed MAC
The sync command automatically matches the DUID to your current (spoofed) MAC address.
Alternative - randomize both separately:
sudo spoofy randomize en0
sudo spoofy duid randomize en0
Manual sync for advanced use:
When using DUID-LL or DUID-LLT types, the DUID includes the MAC address. For consistent spoofing, ensure the MAC in your DUID matches your spoofed MAC:
const spoofy = require('spoofy');
// Spoof MAC
const newMac = '00:11:22:33:44:55';
spoofy.setInterfaceMAC('en0', newMac, 'Wi-Fi');
// Create matching DUID
const duid = spoofy.duid.generateDUID(spoofy.duid.DUID_TYPES.DUID_LL, newMac);
spoofy.duid.setDUID(duid, 'en0');
Coming soon! Linux support is planned but not yet implemented in this fork.
Running MAC change commands on Linux will display a "coming soon" message. You can still use spoofy list to view network interfaces.
The upcoming Linux implementation will use modern ip link commands instead of the deprecated ifconfig tool.
Coming soon! Windows support is planned but not yet implemented in this fork.
Running MAC change commands on Windows will display a "coming soon" message. You can still use spoofy list to view network interfaces.
The upcoming Windows implementation will use PowerShell for more reliable adapter management.
If you encounter errors:
sudo (required for network changes)networksetup -detectnewhardware if changes don't take effectThis is an active fork. Contributions, bug reports, and feature requests are welcome!
MIT License (inherited from original project)
Originally based on the spoof project. This fork maintains compatibility with modern operating systems.
FAQs
Cross-platform MAC address and DUID spoofing utility
We found that spoofy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.