
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
create-trpc-appx
Advanced tools
Scaffold a new tRPC app or run any public tRPC example from GitHub — fast, reliable, workspace‑aware.
🚀 Quick start · ✨ Features · 🧰 Commands · ⚙️ Options · 📦 Templates · 🧭 Monorepos · 🩺 Troubleshooting · 🌟 Star & Sponsor
# Interactive scaffold (pass a name or answer the prompt)
npx create-trpc-appx@latest my-app
# or just:
npx create-trpc-appx@latest
# Scaffold from a bundled template
npx create-trpc-appx@latest my-app --example nextjs-app
# Run an example from GitHub (no scaffold)
create-trpc-appx run trpc/trpc-openapi#master --example-path examples/with-nextjs --prepare-only
Tip: add --yes
to skip prompts. Use --verbose
for debug logs.
If this project helps you, please consider:
Thanks for your support — it helps keep this project healthy and moving forward.
Star on GitHub
·
Sponsor via GitHub Sponsors
⚡ | What | Details |
---|---|---|
🚀 | Fast builds | ESM output via tsup |
🧠 | Smart scripts | Framework heuristics: dev → start/preview → build |
🧭 | Workspace‑aware | Detects npm/yarn/pnpm workspaces and picks the right package |
🛰️ | Robust runner | Cache, offline mode, retries, checksum verification |
🔌 | Env/Ports | Inline env, env-file, fixed/auto ports |
Command | Purpose |
---|---|
create-trpc-appx | Interactive scaffold for a new app |
create-trpc-appx doctor | Diagnose Node, package managers, git, proxy, and network |
create-trpc-appx info [dir] | Show scripts, workspaces, engines for a project |
create-trpc-appx run <github-url> | Fetch, prepare, and run a public example from GitHub |
Option | Type | Default | Description |
---|---|---|---|
-e, --example [name|github-url] | string | — | Use a bundled template or a GitHub URL |
--example-path <path> | string | — | Required when branch contains a slash or to target a subdirectory |
--use-npm / --use-pnpm | flag | auto | Prefer a package manager |
--yes | flag | false | Skip prompts |
--verbose | flag | false | Extra logs |
Option | Type | Default | Description |
---|---|---|---|
--env KEY=VALUE | repeatable | — | Inline env vars to pass |
--env-file <path> | string | — | Load env vars from file |
--port <number> | number | — | Set PORT |
--auto-port | flag | false | Find a free port starting at --port or 3000 |
--script <name> | string | heuristic | Force a specific script |
Option | Type | Default | Description |
---|---|---|---|
--offline | flag | false | Use cache only (no network) |
--no-cache | flag | false | Disable cache and force re‑download |
--cache-dir <path> | string | XDG cache | Use a custom cache dir |
--prepare-only | flag | false | Download/extract (and optionally install) without running |
--no-install | flag | false | Skip dependency installation |
Option | Type | Default | Description |
---|---|---|---|
--prebuild <mode> | auto |always |never | auto | Prebuild before start when appropriate |
Heuristics: Next.js/Remix/SolidStart → dev
→ start
→ build
; Vite/Astro/SvelteKit → dev
→ preview
→ start
.
You can pass --use-npm
or --use-pnpm
with run
as well. The runner otherwise detects npm/yarn/pnpm via lockfiles and packageManager
fields and installs at the appropriate workspace root when needed.
Name | Stack |
---|---|
default | Node + tRPC server + simple client |
nextjs-app | Next.js App Router + tRPC |
vite-react | Vite + React + tRPC |
Use during scaffold with --example <name>
or point to any GitHub example URL.
# Full URL with subdirectory
create-trpc-appx run https://github.com/trpc/trpc-openapi/tree/master/examples/with-nextjs --prepare-only
# Short/SSH forms and explicit example-path
create-trpc-appx run trpc/trpc-openapi#master --example-path examples/with-nextjs
The runner caches archives, verifies checksums, retries transient failures, and falls back to git clone
when necessary. The cache can be safely removed at any time.
The runner scans workspaces (npm/yarn/pnpm) and common subfolders (apps/, packages/) to pick the best runnable directory based on scripts and naming.
The runner detects common frameworks (Next.js, Vite, Remix, Astro, SvelteKit, SolidStart) and picks the best script automatically:
dev
, then start
, then build
.dev
, then preview
, then start
.preview
/start
if a build
script exists (Vite/Astro/SvelteKit), or for start
when build
exists (Next.js/Remix/SolidStart).If current dir has a runnable script → use it.
If workspace root → expand workspace globs and pick the best candidate based on:
dev
> preview
> start
> build
examples
, app
, web
, site
, server
, api
Otherwise, scan first two levels for runnable packages.
HTTP_PROXY
/HTTPS_PROXY
GITHUB_TOKEN
package.json
scripts or pass --script
If you see error: unknown command 'my-app'
when running npx create-trpc-appx my-app
, you're likely on an older CLI that didn't accept a positional project name at the root. Update to the latest version or run without the name and answer the prompt:
npx create-trpc-appx@latest
Run diagnostics:
create-trpc-appx doctor
This CLI can download and run third‑party code. Review sources before running unfamiliar examples. Prefer a sandboxed/test environment when exploring.
Contributions welcome—PRs and issues appreciated.
This project has been based on Create Next App, so a huge thank you goes to every and single one who worked on it.
Attribution for one of the icons used in the logo: Design icons created by monkik - Flaticon
Licensed under MIT.
FAQs
Create tRPC-powered apps with one command
The npm package create-trpc-appx receives a total of 96 weekly downloads. As such, create-trpc-appx popularity was classified as not popular.
We found that create-trpc-appx demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.