
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
create-openstate
Advanced tools
A CLI npm package for creating new Open State project website using SvelteKit. Just run the following and follow the prompts.
npm create openstate@latest
Or if you don't have npm installed
docker run --rm -it -v /home/projects/<YOUR_PROJECT_NAME>:/opt node:22-alpine sh
cd /opt
npm create openstate@latest
# Exit docker
# chown the <YOUR_PROJECT_NAME> folder
cd <YOUR_PROJECT_NAME>
echo 'CORS_ORIGIN=https://<YOUR_DOMAIN_NAME>' > .env
After that you can use either Docker Compose or npm to install and start the project.
docker run --rm -it node:22-alpine sh
cd /opt
mkdir openstate
cd openstate
npm create openstate@latest
npm install
npm run dev -- --open --host
# Open the shown 'Network' URL in your browser (e.g., http://172.17.0.2:5173/)
# Click on the 'Design kit' tab to see the components, layouts and examples
Clone or pull https://github.com/openstate/create-openstate and https://github.com/openstate/create-openstate-template to make sure that you have the latest commits and check that the version number is updated in package.json and package-lock.json.
docker run --rm -it -v <ABSOLUTE_PATH_TO>/create-openstate:/opt/create-openstate -v <ABSOLUTE_PATH_TO>/create-openstate-template:/opt/create-openstate-template node:22 bash
cd /opt
npm install gitignore-parser
git config --global --add safe.directory /opt/create-openstate-template
npm login
npm publish
The folder templates/openstate is based on https://github.com/openstate/create-openstate-template and is updated when running npm build (which is also run during npm publish).
FAQs
A CLI for creating new Open State projects
We found that create-openstate demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.