
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Stackedge is a Termux-friendly app hosting system that allows you to run any web app (Node.js, PHP, Go, etc.) on your Android device. Inspired by the desire to build something decentralized, privacy-focused, and open-source, Stackedge integrates Tor onion services to make your apps accessible anywhere safely.
Your apps start immediately, Tor bootstraps in the background, and you can manage them via a simple CLI (start, stop, restart, list, resurrect).
Features
Run any app (Node.js, PHP, Go, Python…) from the folder you are in.
Tor integration for onion services.
Apps start immediately; Tor bootstraps in the background.
Resilient to Wi-Fi drops or Termux restarts.
stackedge start --
stackedge stop
stackedge restart
stackedge list
stackedge resurrect
Fallback command shows status and help.
Requirements
1.Installation
2.Setup
Usage
1.Termux Auto-Resurrect
Project Philosophy
Android device
Termux installed
Installed Termux packages:
pkg update && pkg upgrade -y
pkg install nodejs git tor -y
Optional for PHP apps:
pkg install php -y
Optional for Go apps:
pkg install golang -y
Optional for Python apps:
pkg install python -y
Clone the Stackedge repository:
cd $HOME
git clone https://github.com/Frost-bit-star/stackedge.git
cd stackedge
Install globally via npm:
npm install -g .
Make sure the CLI is executable:
chmod +x $HOME/.npm-global/bin/stackedge
Verify installation:
stackedge
You should see a status summary and available commands.
Stackedge uses the following directory structure in Termux:
$HOME/.stackedge/
├── apps.json # Stores all app info
├── tor/
│ ├── torrc # Tor config
│ └── services/ # Onion services storage
└── logs/ # App logs
Stackedge automatically creates these directories on first run.
Start an app
Navigate to the app folder and run:
cd ~/my-react-app
stackedge start blog -- npm start
blog is the app name.
Everything after -- is the command to start your app.
Tor starts in the background; your app starts immediately.
Shows:
App name
App state (running/stopped)
Port
Tor state (pending/online)
Onion address
Resurrect all apps
Use this to restore apps after Termux restart or Wi-Fi loss:
stackedge resurrect
Termux Auto-Resurrect
To automatically restore apps when Termux opens:
echo 'if command -v stackedge >/dev/null; then stackedge resurrect >/dev/null 2>&1 & fi' >> ~/.bashrc
Apps will start immediately.
Tor will bootstrap in the background.
No manual intervention needed.
Project Philosophy
Privacy-focused: Tor integration keeps your apps secure and accessible anonymously.
Decentralized hosting on Android: Your device becomes your own server.
Inspired by a love for Termux and building something great, this project is for developers, hackers, and privacy enthusiasts.
Check out my other projects and tutorials: here
If you value open-source and anonymity, support me so I can keep building decentralized hosting tools on Android:
License
MIT License – Open source for everyone.
FAQs
Termux-friendly decentralized app hosting with Tor
We found that stackedge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.