
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
create-core-stack
Advanced tools
Create production-ready full-stack mobile apps with React Native (Expo) and Node.js backend
Beta Release: This is version 0.1.0. Package may change before 1.0.0. Feedback welcome!
Create production-ready full-stack mobile apps with React Native (Expo) and Node.js backend in minutes.
# npm
npx create-core-stack@latest my-app
# yarn
yarn create core-stack my-app
# bun
bunx create-core-stack my-app
Basic mobile app + backend with essential features:
All integrations and features included:
Analytics SDKs with basic features:
# Interactive mode
npx create-core-stack my-app
# With preset template
npx create-core-stack my-app --template minimal
npx create-core-stack my-app --template full-featured
npx create-core-stack my-app --template analytics-focused
# With defaults (minimal preset, no prompts)
npx create-core-stack my-app --defaults
# Show help
npx create-core-stack --help
# Verbose output
npx create-core-stack my-app --verbose
my-app/
├── mobile/ # React Native (Expo) app
│ ├── app/ # Expo Router screens
│ ├── src/ # Components, services, utils
│ └── assets/ # Images, fonts
├── backend/ # Node.js backend
│ ├── controllers/ # API routes
│ ├── domain/ # Business logic
│ └── prisma/ # Database schema
├── docker-compose.yml # Local development
└── scripts/ # Setup utilities
After generating your project:
cd my-app
# Start backend (Docker)
docker-compose up -d
# Setup database
cd backend
npm install
npx prisma migrate dev
cd ..
# Start mobile app
cd mobile
npm install
npm start
Use EAS Build for deployment:
cd mobile
npm install -g eas-cli
eas build --platform ios
eas build --platform android
Deploy to any Node.js hosting:
Configure environment variables from .env.example.
# Install dependencies
npm install
# Build
npm run build
# Run tests
npm test
# Test with coverage
npm run test:coverage
# Run unit tests
npm run test:unit
# Run integration tests
npm run test:integration
# Run e2e tests
npm run test:e2e
# Lint code
npm run lint
# Format code
npm run format
# Type checking
npm run typecheck
Make sure npx is working:
npx --version
Try with explicit version:
npx create-core-stack@latest my-app
Don't use sudo with npx. If you get permission errors:
mkdir ~/.npm-global
npm config set prefix '~/.npm-global'
export PATH=~/.npm-global/bin:$PATH
Make sure you're using Node.js >= 18:
node --version
Ensure Docker is running:
docker --version
docker ps
Q: What's the difference between presets? A: Minimal has basic features, Full-Featured has everything, Analytics-Focused has Adjust + Scate.
Q: Can I add features later? A: Yes, but it's easier to start with more features and remove what you don't need.
Q: Is this production-ready? A: The generated code is production-quality, but this is a beta tool (v0.1.0). Test thoroughly.
Q: What about web support? A: The mobile app is React Native (mobile-only). For web, consider using Expo's web support or a separate web app.
Q: Can I customize the templates? A: Not yet, but template customization is planned for future versions.
Contributions welcome! See CONTRIBUTING.md for guidelines.
See SECURITY.md for vulnerability reporting.
MIT © itharea
FAQs
Create production-ready full-stack mobile apps with React Native (Expo) and Node.js backend
We found that create-core-stack demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.