
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
Template manager for Node applications and libraries. 🐢
Available commands
npx cloneman create my-new-application template-package-name
Keep in mind that template-package-name needs to be published to the npm registry.
You can also refer to a local template file:
npx cloneman create my-new-application ../directory/template.tgz
Note: You can only update your application using the same template it was created with.
To the latest version:
npx cloneman update
You can also update to a specific version:
npx cloneman update 1.2.3
As with the create command, you can also point to a local tarball:
npx cloneman update ../directory/template.tgz
The best way to understand how a template is defined is to check the example template in ./fixtures/base-template.
A template is required to have:
.cloneman
├── build.{js,mjs,ts,mts}
└── cloneman.json
Contains a list of managed files that will be used when creating and updating an application.
{
"managedFiles": ["managed.txt"],
"ignoredDependencies": []
}
List of files owned by the template. These files will be overwritten when updating your application.
List of files to exclude when creating a template.
Supports exact file names or glob patterns, e.g. test/* to remove all test files.
List of dependencies to exclude when creating a template.
Supports exact package names or glob patterns, e.g. @fkui/* to remove all dependencies in the @fkui scope.
Build script to prepare an application or library to be a cloneman template.
Import and call buildTemplate in order to generate a Cloneman template. This function itself returns sub functions to OPT in more features.
import path from "node:path";
import { buildTemplate, readConfigFile, readPackageJson } from "cloneman";
const configFile = path.resolve(import.meta.dirname, "cloneman.json");
const templateRoot = path.resolve(import.meta.dirname, "..");
const pkg = await readPackageJson(templateRoot);
const config = await readConfigFile(configFile);
const targetDir = process.argv[2];
const template = await buildTemplate(pkg.name, pkg, targetDir, config);
await template.renovateIgnoreDependencies();
Append template specific dependencies to the "ignoreDeps" array in the template's "renovate.json".
This makes Renovate ignore dependencies that are managed by the template, while still allowing updates for dependencies that are not template managed.
Both commands requires to be called insisde a template folder.
npx cloneman publish
Publish a new template version to the npm registry. (i.e npm publish)
npx cloneman pack
Creates a local tar file of your template. (i.e npm pack)
npm install
npm run build
npm test
FAQs
Application template and lifecycle management tool
We found that cloneman demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.