
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
create-ultimate
Advanced tools
bunx create-ultimate myapp && cd myapp && bin/setup && x dev
bin/setup is the scaffold's own script and it is not optional: x new writes files and installs
nothing, so x dev on the tree it just wrote fails with X_BUILD_FAILED. The script installs the
dependencies, writes .env.development.local, generates and applies the first migration, and
seeds — idempotent, so it is safe to re-run after every pull.
Thin wrapper over x new — same templates, same flags, no second code path.
| Flag | Does |
|---|---|
--dir <path> | parent directory (default: cwd) |
--no-example | skip the example feature slice |
--dry-run | print the file list, write nothing |
--json | machine-readable output |
What you get: apps/web/{site,app,api,shared}, apps/admin with MCP on, apps/{mobile,desktop}
placeholders, packages/{domain,db,i18n,ui,mcp}, bin/, docker/, app.config.ts — a landing
page at 0kb JS, a streaming authed dashboard, a seeded database and x verify green.
FAQs
bunx create-ultimate myapp — scaffold an Ultimate monorepo
The npm package create-ultimate receives a total of 2,377 weekly downloads. As such, create-ultimate popularity was classified as popular.
We found that create-ultimate demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.