
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
coquito-cli
Advanced tools
Read Documentation for Coquito Framework here
npm install -g coquito-cli
Create a new Coquito Project from the base template with the following command.
coquito newbasicproject
you can also specify the folder name like so:
coquito newbasicproject folderName
Create a new Coquito Project from the Typescript template with the following command.
coquito newtsproject
you can also specify the folder name like so:
coquito newtsproject folderName
create an empty directory and create a "scaffold.js" that looks like this:
{
"graphql": false,
"rpc": false,
"routers": [],
"models" : ["Dog", "Cat"]
"bodyparsers": false,
"views": "hamlet",
"port": 4444,
"host": "0.0.0.0",
"static": false,
"package": {
"name":"my-app",
"description": "this is my-app",
"author": "Alex Merced",
"email": "alexmerced@alexmerced.dev",
"repo": "http://github.com/..."
},
"db": "sql-sqlite3",
"auth": "sql",
"logging": true,
"methodOverride": true
}
Then run the command
coquito scaffold
You project will be scaffolded in the directory. If the config file is somewhere else or under a different name can specify location like this:
coquito scaffold ./scaffold/config.json
Supported View Engines ["ejs", "pug", "hbs", "liquid", "nunjucks", "mustache","twig","hamlet"]
If you don't need a view engine, just assign false or don't include the property
values for auth can be "sql" or "mongo", all other values will be ignored an no auth will be added.
"methodOverride" property will let you override method on form requests by adding a url query in the formal of ?_method=DELETE in the form action attribute.
"logging" will add the morgan logging middleware.
"routers" will add just a blank controller for each endpoint, "models" will create a model file, rest routes and a router for each model specified.
If you have a static folder and graphql or rpc turned on a "clients.js" will be created that provides some basic frontend GraphQL and SimpleRPC clients to use in your frontend code.
You can prepopulate the DATABASE_URL env variable with the dburi property in your scaffold.json
the SECRET env variable will be pre-populated with a random UUID, feel to change it if you like.
You can prepopulate auth with "auth":"mongo" or "auth":"sql" and if done at time of scaffolding the sessions and cookieParser middeware will be pre-registered. Read the comments in ./auth/functions.js
Scaffold connection file for using mongo
coquito add-mongo
Scaffold a mongo model file.
coquito add-mongo-model Dog
Add a new controller file with Index, Show, Create, Update and Delete routes scaffolding for easy CRUD route building.
coquito add-rest-routes dog
Scaffold a Sequalize connection file for connecting to sql databases. Install sequelize and libraries for specified database.
coquito add-sql sqlite3
database options
["pg", "mysql2", "sqlite3", "mariadb", "oracledb", "MSSQL"]
These commands will do the following to speed up implementing auth:
add-auth-mongo
add-auth-sql
FAQs
CLI tool for CoquitoJS
We found that coquito-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.