Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@convenience/create-creator
Advanced tools
A simple node project generator for creating create scripts.
If you name a module with a leading create-
, then you can invoke it with npm init
!
So if you have a module that is published that is called create-applesauce
. You can of
course invoke it with:
$ npx create-applesauce
...or (because it starts with create
) you can...
$ npm init applesauce
Okay, how to use?
cd
into that directory$ npm init @convenience/creator
$ npm init [insert you creator here]
The basic skeleton is this:
const { run } = require('@convenience/create-creator')
const plan = {
queries: [],
actions: []
}
run(plan)
You make a plan and run it. A plan is made yp of queries (which are just prompts for inquirer) and actions. Actions can be any of the following types: copy
, template
, command
.
All actions must have a type and a name, like so:
{
type: 'copy|template|command',
name: 'Some descriptive name',
# ...other stuff...
}
copy
ActionsCopy actions should provide 2 functions. One is files
and IS REQUIRED, it will get passed the answers from the queries allowing you to determine which files to copy based on those answers. It will return an array of objects that contain source
, target
, and files
.
source
: is the directory to copy fromtarget
: is the directory to copy tofiles
: is a glob expression to filter which files to copy.The other function is transform
and it is optional. It will get passed the target path of a file being copied and the query answers so you can dynamically alter the target path (for renaming files and directories based on the answers to queries).
Here is an example copy
action:
{
type: 'copy',
name: 'Copy Files',
files (answers) {
return [{
source: Path.join(__dirname, 'copy'),
target: Path.join(process.cwd(), '.'),
files: `.${Path.sep}**${Path.sep}*`
}]
},
transform (path, answers) {
const filename = Path.basename(path)
const pathname = Path.dirname(path)
return Path.join(pathname,filename.replace(/^_/, '.'))
}
}
This will copy files (and will run in windows ;P) from the create script lib/copy
directory in where ever the create script is being ran. The transform will convert files with a leading underscore(_) to a dot(.) for things like .gitignore
.
template
ActionsExactly like copy
. Only instead of just copying the file, it will load each file like an handlebars template and apply the the answers as a context and write the merged result to the target.
Here's an example:
{
type: 'template',
name: 'Templates',
transform (path, answers) {
const filename = Path.basename(path)
const pathname = Path.dirname(path)
return Path.join(pathname, filename
.replace(/^_/, '')
.replace(/\.hbs$/, ''))
},
files (answers) {
return [{
source: Path.join(__dirname, 'template'),
target: Path.join(process.cwd(), '.'),
files: `.${Path.sep}*`
}]
}
}
Similar to the copy
action, but this one also removes the .hbs
extensions from the source files.
command
ActionsThis allows you to execute shell commands, like: npm install
. Here is an example action that runs npm install
and git init
:
{
type: 'command',
name: 'Commands',
commands (answers) {
return [
{ cmd: 'npm', args: ['install'] },
{ cmd: 'git', args: ['init'] }
]
}
}
This can be dangerous, don't be stupid or mean. Thanks!
FAQs
a simple to generate node projects.
We found that @convenience/create-creator demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.