
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Turn code into Markdown for LLMs with one simple terminal command
Recursively fetches all code files in the current directory, ignoring what's in .gitignore and .codefetchignore, then outputs them into a single Markdown file with line numbers.
Basic usage with output file and tree
npx codefetch -o my-complete-source.md -t
With token limit (useful for AI models):
npx codefetch -tok 20000 -o output.md
Filter by file extensions:
npx codefetch -e .ts,.js -o typescript-files.md
Include or exclude specific files and directories:
# Exclude node_modules and public directories
npx codefetch --exclude-dir=node_modules,public -o output.md
# Include only TypeScript files
npx codefetch --include-files=*.ts -o typescript-only.md
# Include src directory, exclude test files
npx codefetch --include-dir=src --exclude-files=*.test.ts -o src-no-tests.md
If no output file is specified (-o or --output), it will print to stdout.
| Option | Alias | Description |
|---|---|---|
--output <file> | -o | Specify output filename |
--max-tokens <number> | -tok | Limit output tokens (useful for AI models) |
--extension <ext,...> | -e | Filter by file extensions (e.g., .ts,.js) |
--include-files <pattern,...> | -if | Include specific files (supports simple patterns like *.ts) |
--exclude-files <pattern,...> | -ef | Exclude specific files (supports simple patterns like *.test.ts) |
--include-dir <dir,...> | -id | Include specific directories |
--exclude-dir <dir,...> | -ed | Exclude specific directories |
--verbose [level] | -v | Show processing information (0=none, 1=basic, 2=debug) |
--project-tree [depth] | -t | Generate visual project tree (optional depth, default: 2) |
All options that accept multiple values use comma-separated lists. File patterns support simple wildcards:
* matches any number of characters? matches a single characterYou can run directly with npx:
npx codefetch
Or install globally:
npm install -g codefetch
codefetch -o output.md
You can generate a visual tree representation of your project structure:
# Generate tree with default depth (2 levels)
npx codefetch --project-tree
# Generate tree with custom depth
npx codefetch -t 3
# Generate tree and save code to file
npx codefetch -t 2 -o output.md
Example output:
Project Tree:
└── my-project
├── src
│ ├── index.ts
│ ├── types.ts
│ └── utils
├── tests
│ └── index.test.ts
└── package.json
codefetch supports two ways to ignore files:
.gitignore - Respects your project's existing .gitignore patterns.codefetchignore - Additional patterns specific to codefetchThe .codefetchignore file works exactly like .gitignore and is useful when you want to ignore files that aren't in your .gitignore.
By default, it includes:
test/ - All test files and directoriesvitest.config.ts - Vitest configuration fileYou can add more patterns to ignore additional files:
# Default patterns (automatically added)
test/
vitest.config.ts
# Your additional patterns
*.css # all css files
docs/ # documentation directory
Both files support standard gitignore patterns including:
file.txt)dir/)*.log)!important.log)Codefetch uses a set of default ignore patterns to exclude common files and directories that typically don't need to be included in code reviews or LLM analysis.
You can view the complete list of default patterns in default-ignore.ts.
By default, when using the -o or --output option, codefetch will:
codefetch/ directory in your project.codefetchignore file (if it doesn't exist) that includes test files and configurationThis ensures that:
We recommend adding codefetch/ to your .gitignore file to avoid committing the fetched codebase.
You can use this command to create code-to-markdown in bolt.new, cursor.com, ... and ask the AI chat for guidance about your codebase. The -tok option helps ensure your output stays within AI model token limits.
The --verbose or -v option supports different levels of output:
# No verbose output (just results)
npx codefetch -o output.md
# Basic progress information (level 1)
npx codefetch -v -o output.md
# or
npx codefetch -v 1 -o output.md
# Detailed debug information (level 2)
npx codefetch -v 2 -o output.md
Verbose levels:
MIT
This project was inspired by
FAQs
Fetches all files in the current directory and outputs them in a Markdown file.
The npm package codefetch receives a total of 769 weekly downloads. As such, codefetch popularity was classified as not popular.
We found that codefetch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.