
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
@aiherrera/create-turbo
Advanced tools
CLI to scaffold production-ready Turborepo monorepos with TypeScript, React, Tailwind CSS, Biome, Lefthook, Docker (PostgreSQL + Redis), and automated CI/CD
CLI to scaffold production-ready Turborepo monorepos with TypeScript, React, Tailwind CSS, Biome, Lefthook, Docker (PostgreSQL + Redis), and automated CI/CD.
pnpm create @aiherrera/turbo my-app
cd my-app
pnpm dev
npm create @aiherrera/turbo my-app
cd my-app
npm run dev
yarn create @aiherrera/turbo my-app
cd my-app
yarn dev
bun create @aiherrera/turbo my-app
cd my-app
bun dev
pnpx @aiherrera/create-turbo my-app
# or
npx @aiherrera/create-turbo my-app
pnpm create @aiherrera/turbo [project-name] [options]
[project-name] - Name of your project (optional, will prompt if not provided)-p, --package-manager <manager> - Package manager to use (pnpm, npm, yarn, bun)--skip-install - Skip installing dependencies--skip-git - Skip git initialization--with-addons <addons> - Comma-separated list of add-ons to include (e.g., expo)-h, --help - Display help-V, --version - Display version# Interactive mode (prompts for project name, package manager, and add-ons)
pnpm create @aiherrera/turbo
# With project name
pnpm create @aiherrera/turbo my-awesome-app
# With specific package manager
pnpm create @aiherrera/turbo my-app -p npm
# With add-ons (Expo mobile app)
pnpm create @aiherrera/turbo my-app --with-addons expo
# Skip dependency installation (useful for CI/CD)
pnpm create @aiherrera/turbo my-app --skip-install
# Skip git initialization
pnpm create @aiherrera/turbo my-app --skip-git
# Combine options
pnpm create @aiherrera/turbo my-app -p yarn --with-addons expo --skip-git
This CLI scaffolds a production-ready Turborepo monorepo with:
Enhance your monorepo with optional add-ons during setup or by using the --with-addons flag:
expo)apps/mobile-expo@repo/uiturbo.json: Adds Expo-specific build outputs (android/app/build/**, ios/build/**, .expo/**)biome.json: Adds Expo directory exclusions (!.expo, !android, !ios)# Interactive selection (prompts during setup)
pnpm create @aiherrera/turbo my-app
# Via CLI flag
pnpm create @aiherrera/turbo my-app --with-addons expo
# Multiple add-ons (when more become available)
pnpm create @aiherrera/turbo my-app --with-addons expo,other
This CLI clones from: Lynsoft/turborepo-template
# Clone the repository
git clone https://github.com/Lynsoft/create-turbo.git
cd create-turbo
# Install dependencies
pnpm install
# Run tests (automatically builds first)
pnpm test
# Or build manually
pnpm build
# Test locally
pnpm link --global
pnpm create @aiherrera/turbo test-app
This project uses semantic-release for automated versioning and publishing to npm.
Commit with conventional commits (required):
git commit -m "feat: add new feature"
git commit -m "fix: resolve bug"
git commit -m "docs: update README"
Push to main branch:
git push origin main
Automated release (GitHub Actions):
feat: → Minor version bump (1.0.0 → 1.1.0)fix: → Patch version bump (1.0.0 → 1.0.1)perf: → Patch version bumpdocs: → Patch version bumpBREAKING CHANGE: → Major version bump (1.0.0 → 2.0.0)chore:, test:, ci: → No releaseThis project uses npm Trusted Publishing (provenance) for secure, token-free publishing.
Configure npm Trusted Publishing:
Lynsoft/create-turbopublish.ymlGITHUB_TOKEN: Automatically provided by GitHub Actions (no setup needed)
If you can't use Trusted Publishing:
NPM_TOKENNote: Trusted Publishing is more secure and doesn't require managing tokens!
MIT © Alain Iglesias
FAQs
CLI to scaffold production-ready Turborepo monorepos with TypeScript, React, Tailwind CSS, Biome, Lefthook, Docker (PostgreSQL + Redis), and automated CI/CD
We found that @aiherrera/create-turbo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.