
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@mkvlrn/newts
Advanced tools
This is a very VERY VERY opinionated CLI tool and set of templates for the setup of a few different TypeScript projects with a focus on code quality and consistency from the start.
It attempts to provide a minimalistic setup with modern tools and practices without bloat - but bloat means different things to different people, so your mileage may vary.
Usage is as follows: npx --yes @mkvlrn/newts@latest. The CLI is interactive.
The --yes flag is used to skip the npx confirmation prompt, and the @latest tag is used to ensure you are always getting the latest version of the tool.
discord.jsEach project will be an ESM (type: module) project with the following tools and configurations:
.gitignore fileEach available CLI out there brings some opinions and tools that might not be what you want or need, and this one is no different. The main difference is that this one is my opinion, and I'm sharing it with you.
Instead of using create-vite, @nestjs/cli, or create-next-app tools to initialize those projects, this CLI tool will do it from scratch, adding only the tools and configurations that I think are necessary for a good starting point (see above).
NestJs and Next.js have their own way of doing things, and both of them are okay, but I think they can be improved. Also they seem to be very resistant to moving to ESM, and that's a shame.
Just generate a project and see for yourself. If you have any questions, feel free to open an issue or a PR.
The defaults are opinionated, but very sane and easy to adapt to your needs.
FAQs
A very opinionated cli tool for setting up multiple typescript projects
We found that @mkvlrn/newts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.