
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Deterministic UI/UX testing and evidence platform for AI-assisted remediation
Deterministic UI/UX testing and evidence platform for AI-assisted remediation.
ux-audit audits one or more URLs using deterministic checks (Axe + Lighthouse), then writes a structured evidence bundle your AI agent (or team) can use to prioritize and implement fixes.
auth, forms, crud)>=18npm install ux-audit
If you are developing this repo locally:
npm install
npm run build
npm run install:browsers
Audit a single page:
npx ux-audit audit https://example.com
Audit multiple URLs:
npx ux-audit audit --urls https://example.com/,https://example.com/docs --out ./test-run
Audit with base URL + paths:
npx ux-audit audit --base-url https://example.com --paths /,/pricing,/docs --patterns auth,forms
Show CLI help:
npx ux-audit --help
ux-audit audit [url] [options]
Scope (choose one):
url (positional) or --url <url>--urls <url1,url2,...>--base-url <url> --paths <path1,path2,...>Options:
--out <dir> output directory (default: ./ux-audit-bundle)--patterns <id,id,...> enable pattern-specific checks--include-screenshots include screenshots (default: enabled)--no-screenshots disable screenshots--include-dom-snapshot include page HTML snapshots--storage-state <path> Playwright auth state JSON--config <path> config file path override--help, -hExit codes:
0 success with no critical findings1 critical findings exist (or runtime failure)By default, the CLI looks for:
ux-audit.config.jsonux-audit.config.js.ux-audit.jsonRecommended config format (ux-audit.config.json):
{
"baseUrl": "https://example.com",
"paths": ["/", "/docs"],
"patterns": ["auth", "forms"],
"out": "./custom-out",
"auth": {
"storageState": "./playwright-auth.json"
}
}
Supported fields:
urls: string[]baseUrl: stringpaths: string[]patterns: string[]out: stringauth.storageState: stringCLI arguments override config values.
Available pattern IDs:
authformscrudnavigationonboardingsearch-filterempty-error-loadingsettingsdashboardscheckoutcontent-displaymodals-overlaysdata-tables// Example snippet
await context.storageState({ path: "playwright-auth.json" });
npx ux-audit audit https://yourapp.com/dashboard --storage-state ./playwright-auth.json --out ./test-run
Security note: storage state contains session data. Never commit it.
For each run, ux-audit writes:
ux-audit-report.json machine-readable findingsux-audit-report.md human-readable summaryindex.json manifest with scope, patterns, and artifact pathsa11y/*.json per-page Axe + heuristics artifactsmetrics/*.json per-page Lighthouse artifactsscreenshots/*.png when screenshots are enabledsnapshots/*.html when --include-dom-snapshot is enabledpatterns.json when pattern IDs are enabledAGENT_PROMPT.md guide for consuming findings in an AI workflownpm run build compile TypeScriptnpm run test run Jest testsnpm run test:node run Node test runnernpm run install:browsers install Playwright Chromiumnpm run audit -- <args> run CLI through package scriptnpm run audit:demo run demo audit against https://example.comThe package currently exports:
runAudit from src/pipeline/runAudit.tsgetPatternIds from src/patterns/catalog.tssrc/report/types.tsMIT
FAQs
Deterministic UI/UX testing and evidence platform for AI-assisted remediation
We found that ux-audit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.