Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
create-now
Advanced tools
Create projects from templates. This CLI will bootstrap templates from the /template
directory in a GitHub repository linked to form an npm-package.
Install template for compatible packages like this:
bun create now zero-configuration
bunx create-now zero-configuration . web
bun create now npm-package-name [destination] [template] [variable-values]
The second argument can be used to describe the location where to place the project while the third describes the template to use. Both parameters are optional. If no location is provided the current directory will be used. If there is more than one template available for the package, but no template selected then a prompt will appear.
Use the zero-configuration
configuration tool with the web
template and place result in /my-site
folder.
bun create now zero-configuration my-site web
Create a React Native app managed with numic
inside the /my-app
folder avoiding the prompt for a bundle name by presetting the variable.
bun create now numic my-app default name=tesla
The following npm packages provide templates to install with now
.
To configure your package to allow templates to be generated with this plugin you will need a /template
folder at the top level.
repository-root
│ README.md
│ package.json
└───template
│ package.json
└ index.js
If you want to provide several templates create a folder for each one inside /template
and now
will prompt the user which one to use. For this to work it's important that there are no other files located in the template root. If there is a default
named template available and the user has not selected a template to be used on invocation this one will be used without prompting.
repository-root
│ ...
└───template
├───javascript
│ │ package.json
│ └ index.js
│
├───typescript
│ │ package.json
│ │ index.ts
│ └ tsconfig.json
│
└───[default]
└ package.json
It's not necessary that the templates are published to npm as they will be downloaded from the git repository linked in the package.json
of the respective plugin.
Template files can be enhanced with static or user-defined variables. Use the EJS to place them in any of your files. Here is an example of a dynamic package.json
:
{
"name": "<%= name %>",
"description": "<%= description %>"
}
The variable contents need to be defined in a template.json
file at the top of your template. Variables are static and need to be defined in advance, while prompts are dynamic and will be prompted to the user when the template is generated. The syntax for prompts matches the npm package with the same name.
{
"variables": {
"name": "my-plugin"
},
"prompts": [
{
"name": "description"
}
]
}
To avoid the prompt the variables can also be supplied as arguments:
bun create now padua ./my-plugin typescript name=my-plugin description="What it does."
In the optional template.json
file you can add further options to configure the process.
{
"variables": {...},
"prompts": [...],
"noInstall": true,
"excludeTransform": ["index.html"]
}
noInstall
[false] prevents npm install even if dependencies or devDependencies found in package.json
excludeTransform
[none] template variables like <% whatever %>
will be ignored, only one's with <# here #>
will be replaced.
import { create } from 'create-now'
await create('papua')
// Arguments two and three are optional.
// Will throw an error if there are several templates but none has been selected.
await create('padua', 'new-plugin', 'javascript')
// Use '.' for the second argument for current folder.
await create('papua', '.')
FAQs
Create projects from templates.
The npm package create-now receives a total of 9 weekly downloads. As such, create-now popularity was classified as not popular.
We found that create-now demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.