
Security News
Feross on TBPN: How North Korea Hijacked Axios
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.
userscript-to-electron
Advanced tools
Convert Tampermonkey/Greasemonkey userscripts to Electron-compatible JavaScript
An npm package that converts Tampermonkey or Greasemonkey userscripts into Electron-executable JavaScript.
This project tracks Tampermonkey documentation and implements a broad GM API compatibility layer.
Chinese documentation: README.zh-CN.md
Compatibility notes:
GM_* and modern GM.* API styles.@grant GM and expands it to the full GM namespace bridge.GM.xmlHttpRequest and GM_xmlHttpRequest compatibility aliases.Storage APIs:
GM_getValue, GM_setValue, GM_deleteValue, GM_listValuesGM_setValues, GM_getValues, GM_deleteValuesGM_addValueChangeListener, GM_removeValueChangeListenerNetwork APIs:
GM_xmlhttpRequestGM_downloadGM_webRequest (experimental)UI APIs:
GM_notificationGM_openInTabGM_registerMenuCommand, GM_unregisterMenuCommandDOM and style APIs:
GM_addElementGM_addStyleResources and clipboard APIs:
GM_getResourceText, GM_getResourceURLGM_setClipboardTab and info APIs:
GM_getTab, GM_saveTab, GM_getTabsGM_infoGM_logCookie and audio APIs:
GM_cookie.list, GM_cookie.set, GM_cookie.deleteGM_audio.setMute, GM_audio.getStateGM_audio.addStateChangeListener, GM_audio.removeStateChangeListenerWindow globals:
unsafeWindowwindow.close, window.focuswindow.onurlchangeSupports common Tampermonkey headers including:
@name, @namespace, @version, @description, @author@match, @include, @exclude, @connect@grant, @require, @resource@run-at, @run-in, @sandbox@updateURL, @downloadURL, @supportURL, @homepage@noframes, @unwrap, @tag, @antifeature@name:zh-CN, @description:ennpm install userscript-to-electron
import UserscriptConverter from 'userscript-to-electron';
import fs from 'fs';
const converter = new UserscriptConverter({
dataDir: './userscript-data'
});
const scriptContent = fs.readFileSync('my-script.user.js', 'utf-8');
const result = converter.convert(scriptContent);
console.log(result.metadata.name);
converter.save(result, 'output.js');
const { app, BrowserWindow, ipcMain } = require('electron');
const path = require('path');
const UserscriptConverter = require('userscript-to-electron');
const converter = new UserscriptConverter({
dataDir: path.join(app.getPath('userData'), 'userscripts')
});
ipcMain.handle('userscript:run', async (_event, scriptPath) => {
const result = converter.convertFile(scriptPath);
const win = BrowserWindow.getFocusedWindow();
if (win) {
await win.webContents.executeJavaScript(result.code);
}
return result.metadata;
});
new UserscriptConverter(options?: ConvertOptions)
Methods:
convert(scriptContent: string): ConvertResultconvertFile(filePath: string): ConvertResultsave(result: ConvertResult, outputPath: string): voidConvertResult:
interface ConvertResult {
code: string;
metadata: UserscriptMetadata;
sourceMap?: string;
}
MetadataParser.parse(scriptContent: string): UserscriptMetadata
new GMPolyfill(options?: GMPolyfillOptions)
generatePolyfill(grants: string[]): string
${dataDir}/__gm_storage.json.${dataDir}/__gm_tabs.json.${dataDir}/downloads/.GM_webRequest behavior depends on integration context and is currently experimental.npm run build
npm run dev
npm test
MIT. See LICENSE.
FAQs
Convert Tampermonkey/Greasemonkey userscripts to Electron-compatible JavaScript
We found that userscript-to-electron demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.

Security News
OpenSSF has issued a high-severity advisory warning open source developers of an active Slack-based campaign using impersonation to deliver malware.

Research
/Security News
Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.