Five proxy clients replace a dedicated iOS build
Five module formats cover Shadowrocket, Surge, Loon, Quantumult X, and Stash. Each asks the proxy to intercept Apple's /clls/wloc response and replace coordinates before iOS calculates a location. The main script handles Wi-Fi entries and cell-tower fields, while a separate file serves Quantumult X. This avoids a jailbreak, Xcode, and an Apple developer account. It does require a commercial or third-party proxy client capable of editing response bodies.
The current Chinese README describes 4 response envelopes: ARPC, synthetic, marker, and bare. If parsing those formats fails, the script scans the raw bytes for coordinate messages. It changes latitude, longitude, and an existing accuracy field while passing through altitude, vertical accuracy, and motion state. That narrow rewrite is meant to reduce rejected responses. It remains tied to an undocumented Apple exchange, so changes in the request path can stop the module before its parser runs.
Five intercepted hostnames make certificate trust unavoidable
The modules list 5 hostnames for HTTPS interception, including Apple location services and two AutoNavi forms. Setup requires installing the proxy's CA and enabling full trust in iOS settings. That is a serious permission: the project warns that the proxy can see traffic to the intercepted endpoints and advises enabling the module only while it is needed. Keep the CA private material on the device and avoid broad wildcards that would capture unrelated Apple requests.
Surge adds a licensing trap documented in issue 63. The reporter had imported the module, enabled the listed hosts, trusted the certificate, and reconnected the VPN, yet location did not change because response-body rewriting was an unlockable Surge feature. This is a good example of why the import step is not enough. A useful smoke test needs the proxy log, a confirmed rewritten response, and a map check on the same phone.
What happened when we ran it
Our sandbox used Node 22 with 3 CPUs and 8 GB of RAM, then installed the project under location-picker/worker/. Npm completed in 70 seconds, adding 43 packages and consuming 217 MB on disk. The audit found 0 known vulnerabilities across critical, high, moderate, and low severities. These figures cover the optional Cloudflare Worker picker at commit f183fd9, not the iPhone proxy scripts or the Node server.
The measured checkout contained 39 files, about 6,852 lines of source, and occupied 0.4 MB before installation. There was no build script or target, so the build step was skipped. There was also no test script or target, so no tests ran, even though the scan found a tests directory. The repository had 0 CI workflow files and no Dockerfile. The clean install says Wrangler resolves; it does not prove coordinate rewriting on iOS.
The map picker turns one module into an optional service
The README presents 5 picker deployments: Cloudflare Worker through Wrangler, Cloudflare's web dashboard, Railway, a self-hosted Node server, and Docker. A generated configuration URL lets Loon or Shadowrocket fetch the chosen coordinate. This is useful for repeated QA because the tester taps a map instead of editing module arguments. It also creates another access-control surface, especially if the URL reaches the public internet.
The full server requires Node 24 because it uses the built-in SQLite module. At least one user or admin token must exist before a new database starts. User coordinates, access logs, and usage summaries go into SQLite, while place search and elevation call Nominatim and open-meteo. The README documents retention, archival, and a health endpoint. Those are thoughtful operator details, but they are separate from the lightweight Worker installation our lab measured.
iOS 27 beta 7 reports show how abruptly the method can fail
Open issue 79 concerns iOS 27 beta 7. One commenter reports successful MITM connections to Apple but no /clls/wloc HTTP response, leaving the script with nothing to modify. Issue 76 reports that beta 7 shows the current location as unavailable. The main README recommends a device reboot for iOS 26 and 27 caching, but an absent request cannot be fixed by clearing a cached coordinate.
App coverage also varies on the same phone. Issue 78 reports that Maps and Weather used the changed location while two banking apps exposed the actual one; a commenter saw a similar split with AutoNavi and bank software. The project only rewrites network-derived location, and the README says strong GPS may override it. Test every target app separately, with the exact iOS and proxy versions recorded.
Five-host Chinese instructions are ahead of the English README
The Chinese README lists 5 intercepted domains and says motion data now passes through unchanged. The English README lists 4 domains in one Loon note and still says the port rewrites motion state. It also labels Quantumult X untested while the Chinese page gives a broader current support table. English documentation exists, which is better than leaving international users to machine translation, but the conflicting technical claims make the Chinese file the safer reference today.
GitHub records the last push on September 3, 2026, and issue activity on the same date. The repository had 3,858 stars and 28 combined issues and pull requests when fetched. There is no latest tagged release, so users must pin a commit or accept main-branch changes. Current maintenance and quick issue traffic are positive signs for a project created on June 30, but two months of history is too little to establish stable behavior across iOS updates.