
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
create-mg-app
Advanced tools
参考 @vite/create-app 和 vue-cli@2.9.6
需要 Node.js 版本 >=12.0.0.
# 使用 yarn
yarn create mg-app
# 使用 npm
npm init mg-app
然后跟随提示操作!
也可以直接指定项目名称和要使用的模板,详细用法如下:
yarn create mg-app [project_name] \
[-t/--template <template_name>] \
[--repo [github|gitlab:][hostname:]repo_owner/repo_name[#branch]] \
[--auth "<username>: <password>"] \
[--token: <private_token>] \
[--header "Private-Token: <private_token>"] \
[--offline] \
[-h/--help]
创建项目,且命名为 my-project
yarn create mg-app my-project
创建项目,使用 离线模板(模板已经缓存在本地)
yarn create mg-app --offline
创建项目,指定使用 vue3 模板
yarn create mg-app -t vue3
创建名称为 my-project 的项目,使用 离线模式,并指定模板为 vue3
yarn create mg-app my-project --offline -t vue3
创建项目,使用 github 公有仓库(将设仓库所有者为 owner,仓库名为 my-public,分支为 dev)
yarn create mg-app --repo owner/my-public#dev
创建项目,使用 gitlab 公有仓库(仓库类型为 gitlab,将设主机名为 hostname,仓库所有者为 owner,仓库名 my-public)
yarn create mg-app --repo gitlab:hostname:owner/my-public
创建项目,使用 gitlab 私有仓库(使用 个人访问令牌 验证身份)
yarn create mg-app --repo gitlab:hostname:owner/my-private --token 9koXpg98eAheJpvBs5tK
创建项目,使用 gitlab 私有仓库(使用 用户名和密码 验证身份,该验证方式只支持了 gitlab,优先使用 个人访问令牌)
yarn create mg-app --repo gitlab:hostname:owner/my-private --auth "hdcljt: 1qaz@WSX"
另外:
默认仓库配置为
hdcljt/create-app#old,但是主要用途是下载维护在 gitlab 上私有的模板仓库(即用法示例 7)
仓库下载后,模板缓存在~/.mg-templates/templates/目录。--offline离线模式也是读取的此目录
--token和--auth的参数配置会缓存在本地的~/.mg-templates/config.json文件中,即在没有输入的情况下会优先读取缓存中的token(其次auth)
您可以在 GitLab 个人资料中创建任意数量的个人访问令牌。
GitLab 帐户User Settings > Access TokensGitHub 会自动删除一年内未使用过的个人访问令牌
GitHub 帐户Settings > Developer settings > Personal access tokensFAQs
We found that create-mg-app demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.