
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
create-wordpress-block
Advanced tools
Generates PHP, JS and CSS code for registering a block for a WordPress plugin.
Create WordPress Block is an officially supported way to create blocks for registering a block for a WordPress plugin. It offers a modern build setup with no configuration. It generates PHP, JS, CSS code, and everything else you need to start the project.
It is largely inspired by create-react-app. Major kudos to @gaearon, the whole Facebook team, and the React community.
Blocks are the fundamental element of the WordPress block editor. They are the primary way in which plugins and themes can register their own functionality and extend the capabilities of the editor.
Visit the Gutenberg handbook to learn more about Block API.
You just need to provide the slug which is the target location for scaffolded
files and the internal block name.
$ npm init wordpress-block todo-list
$ cd todo-list
$ npm start
(requires node version 10.0.0 or above, and npm version 6.1.0 or above)

You don’t need to install or configure tools like webpack, Babel or ESLint yourself. They are preconfigured and hidden so that you can focus on the code.
The following command generates PHP, JS and CSS code for registering a block.
$ npm init wordpress-block [options] [slug]
[slug] is optional. When provided it triggers the quick mode where it is used
as the block slug used for its identification, the output location for scaffolded files,
and the name of the WordPress plugin. The rest of the configuration is set to all
default values.
Options:
-t, --template <name> template type name, allowed values: "es5", "esnext" (default: "esnext")
-V, --version output the version number
-h, --help output usage information
More examples:
$ npm init wordpress-block
npm start) which enables ESNext and JSX support.$ npm init wordpress-block --template es5
npx to output usage information.$ npx create-wordpress-block --help
When you scaffold a block, you must provide at least a slug name, the namespace
which usually corresponds to either the theme or plugin name, and the category.
In most cases, we recommended pairing blocks with plugins rather than themes,
because only using plugin ensures that all blocks still work when your theme changes.
Inside that bootstrapped directory (it doesn't apply to es5 template), you
can run several commands:
$ npm start
Starts the build for development.
$ npm run build
Builds the code for production.
$ npm run lint:css
Lints CSS files.
$ npm run lint:js
Lints JavaScript files.
Another way of making a developer’s life easier is to use WP-CLI,
which provides a command-line interface for many actions you might perform on
the WordPress instance. One of the commands wp scaffold block was used as
the baseline for this tool and ES5 template in particular.

FAQs
Generates PHP, JS and CSS code for registering a block for a WordPress plugin.
We found that create-wordpress-block demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.