
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
create-express-starter-ts
Advanced tools
Create a new Express project with a bunch of goodies pre-configured.
A small, opinionated starter for TypeScript + Express APIs. Choose a minimal setup or an advanced layout with useful defaults for building APIs.
@t3-oss/env-core: Type-safe environment variable parsing and validation.dotenv-cli: Loads environment variables from .env files.tsx: Instantly run TypeScript files without precompilation.tsc-alias: Resolves TypeScript path aliases in compiled JavaScript.@asteasolutions/zod-to-openapi: Generates OpenAPI 3.x documentation from Zod schemas and Express routes.@neondatabase/serverless: Serverless PostgreSQL driver for Neon database integration.@valkey/valkey-glide: High-performance Valkey (Redis-compatible) client for caching and data storage.cors: Middleware to enable Cross-Origin Resource Sharing.express-zod-safe: Request validation middleware powered by Zod.req.auth and route protection helpers.To use create-express-starter-ts, you can run it directly using npx, pnpx, bun x, or yarn create.
Alternatively, if you want to build the CLI from scratch, clone this repository and follow the development instructions.
To create a new Express project, run one of the following commands:
npx create-express-starter-ts@latest [project-name]
pnpx create-express-starter-ts@latest [project-name]
bun x create-express-starter-ts@latest [project-name]
yarn create express-starter-ts [project-name]
Replace [project-name] with the desired name for your new project. If [project-name] is omitted, the CLI will prompt you for the project directory.
The CLI will prompt you for the following information:
. for the current directory, or a new directory name like my-express-app).$ npx create-express-starter-ts@latest
? Where would you like to create your project? › my-express-app
? Which Express setup would you like? › Basic Express Setup
? Would you like to initialize a git repository? › Yes
? Would you like to install dependencies? › Yes
# ... CLI output for project creation, git init, and dependency installation ...
Project created successfully! 🎉
Next steps:
cd my-express-app
pnpm run dev
The "Advance Express Setup" provides a robust structure for scalable Express applications:
.
├── src/
│ ├── api/
│ │ └── v1/
│ │ ├── controllers/
│ │ │ ├── health.controller.ts
│ │ │ └── user.controller.ts
│ │ ├── docs/
│ │ │ └── openapi.ts
│ │ ├── routes/
│ │ │ ├── health.routes.ts
│ │ │ └── user.route.ts
│ │ ├── schemas/
│ │ │ └── user.schema.ts
│ │ └── validators/
│ │ └── user.validators.ts
│ ├── drizzle/
│ │ ├── index.ts
│ │ ├── schema.ts
│ │ └── auth-schema.ts
│ ├── docs/
│ │ └── docs.route.ts
│ ├── middlewares/
│ │ ├── swaggerMiddleware.ts
│ │ ├── rateLimit.middleware.ts
│ │ └── auth.middleware.ts
│ ├── services/
│ │ ├── logger.ts
│ │ ├── valkey-store.ts
│ │ ├── valkey.ts
│ │ └── valkey.md
│ ├── types/
│ │ └── express.d.ts
│ ├── utils/
│ │ ├── api-response.ts
│ │ ├── env.ts
│ │ ├── openapiRegistry.ts
│ │ ├── try-catch.ts
│ │ └── auth.ts
│ ├── index.ts
│ └── zod-extend.ts
├── .env
├── .gitignore
├── package.json
├── tsconfig.json
└── ...
The advanced template comes with a comprehensive set of features for building production-ready APIs:
For detailed configuration and usage, see the Guides documentation.
The "Advance Express Setup" includes comprehensive OpenAPI (Swagger) documentation generated using zod-to-openapi. This integration ensures that your API documentation is always in sync with your Zod schemas, providing type-safe and accurate specifications for your endpoints.
Key Features:
Relevant Files:
src/api/v1/docs/openapi.ts: Configures the OpenAPI document, including API info, servers, and security schemes. It imports and registers all necessary routes and schemas.src/utils/openapiRegistry.ts: A shared registry instance used to collect all OpenAPI definitions (paths, schemas, components) from various parts of your application.src/api/v1/routes/*.ts: API route files where endpoints are defined and registered with the OpenAPI registry using registry.registerPath().src/api/v1/schemas/*.ts: Zod schema files that define the structure of your request and response data. These schemas are automatically picked up by zod-to-openapi.src/middlewares/swaggerMiddleware.ts: Handles serving the OpenAPI JSON and setting up Swagger UI.src/docs/docs.route.ts: Defines the routes for accessing the Swagger UI documentation.To view the API documentation, start your advanced Express application and navigate to http://localhost:3000/docs/v1 (assuming default port 3000).
To develop create-express-starter-ts itself:
pnpm dev # Starts TypeScript in watch mode
To build the CLI for distribution:
pnpm build
This will compile the TypeScript code to JavaScript and copy the templates directory into the dist folder.
This project is licensed under the MIT License.
FAQs
Create a new Express project with a bunch of goodies pre-configured.
We found that create-express-starter-ts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.