
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@grant/mgit
Advanced tools
Clone all repos for a GitHub user or organization.
npm i -g @grant/mgit
--pull to git pull in existing repos (off by default)--timeout=SECONDS; timed-out repos retried at end; slow/skip/fail clearly markedmgit clone [owner] # Clone all repos (default: authenticated user)
mgit init [token] # One-time: create ~/.mgit.json with your token
mgit status # List repos cloned for this user/org
Clones every repository at github.com/<owner> (user or org) into the current directory. If you omit owner, it uses the GitHub user for your saved token.
mgit clone # clone all repos for the authenticated user
mgit clone google # clone all of google's repos
mgit clone --pull # clone missing repos and git pull in existing ones
mgit clone --timeout=120 # 2-minute timeout per clone (default: 300)
After cloning, mgit writes a .mgit.json file in the current directory with the owner and list of repo names so mgit status knows what you have.
Prints the owner and list of repos that were cloned in this directory (from .mgit.json).
mgit status
# grant (42 repos)
# grant/mgit
# grant/other-repo
# ...
Create the global config with your GitHub token. Create a token at github.com/settings/tokens (scope: repo), then:
mgit init <your-token>
This creates ~/.mgit.json with your token.
npm installnpm run build — puts mgit on your PATH using this checkout.mgit init <token> — use a GitHub token with repo scope.Watch: Use two terminals.
npm run dev — recompiles when you save a .ts file.mgit clone, mgit status, etc. — each run uses the latest code.You can publish from your machine or let the release pipeline publish when you merge a release PR.
package.json (e.g. set "version": "1.0.1") or run npm version patch / minor / major.npm run build:cinpm login — enter username, password, and OTP if you use 2FA.npm publish --access public (required for scoped packages like @grant/mgit). With 2FA you’ll be prompted for a one-time password; pass it inline with npm publish --access public --otp=123456 if you prefer.Then npm i -g @grant/mgit will install the new version.
fix:, feat:, or feat!: (breaking) in commit messages so Release Please can bump the version.main, Release Please opens or updates a release PR (version + CHANGELOG). Merge it to create the GitHub release.After each merged release PR, the new version is on npm and installable with npm i -g @grant/mgit.
FAQs
Clone all repos for a GitHub user or organization
We found that @grant/mgit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.