
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
Expect this project to have worse maintainance than degit or tiged(which is going to be used as upstream)
If, for some odd reason, you need to use degit to programmatically get stuff from github and you want to use degit but you can't count on git being the your users machines then you can use degitdegit which relies on isomorphic-git (which makes it heavier obviously)
degit makes copies of git repositories. When you run degit some-user/some-repo, it will find the latest commit on https://github.com/some-user/some-repo and download the associated tar file to ~/.degit/some-user/some-repo/commithash.tar.gz if it doesn't already exist locally. (This is much quicker than using git clone, because you're not downloading the entire git history.)
Requires Node 8 or above, because async and await are the cat's pyjamas
npm i --save degitdegit
const degit = require('degitdegit');
const emitter = degit('user/repo', {
cache: true,
force: true,
verbose: true
});
emitter.on('info', info => {
console.log(info.message);
});
emitter.clone('path/to/dest').then(() => {
console.log('done');
});
The simplest use of degit is to download the master branch of a repo from GitHub to the current working directory:
degit('user/repo');
//these are equivalent
degit('github:user/repo');
degit('git@github.com:user/repo');
degit('https://github.com/user/repo');
Or you can download from GitLab and BitBucket:
(won't be actively tested)
//download from GitLab
degit('gitlab:user/repo');
degit('git@gitlab.com:user/repo');
degit('https://gitlab.com/user/repo');
//download from BitBucket
degit('bitbucket:user/repo');
degit('git@bitbucket.org:user/repo');
degit('https://bitbucket.org/user/repo');
//download from Sourcehut
degit('git.sr.ht/user/repo');
degit('git@git.sr.ht:user/repo');
degit('https://git.sr.ht/user/repo');
degit('user/repo#dev'); //branch
degit('user/repo#v1.2.3'); //release tag
degit('user/repo#1234abcd'); //commit hash
To clone a specific subdirectory instead of the entire repo, just add it to the argument:
degit('user/repo/subdirectory');
Private repos can be cloned by specifying --mode=git (the default is tar). In this mode, Degit will use git under the hood. It's much slower than fetching a tarball, which is why it's not the default.
Note: this clones over SSH, not HTTPS.
git clone --depth 1?A few salient differences:
git clone, you get a .git folder that pertains to the project template, rather than your project. You can easily forget to re-init the repository, and end up confusing yourself.tar.gz file for a specific commit, you don't need to fetch it again).degit user/repo instead of git clone --depth 1 git@github.com:user/repo)You can manipulate repositories after they have been cloned with actions, specified in a degit.json file that lives at the top level of the working directory. Currently, there are two actions — clone and remove. Additional actions may be added in future.
// degit.json
[
{
"action": "clone",
"src": "user/another-repo"
}
]
This will clone user/another-repo, preserving the contents of the existing working directory. This allows you to, say, add a new README.md or starter file to a repo that you do not control. The cloned repo can contain its own degit.json actions.
// degit.json
[
{
"action": "remove",
"files": ["LICENSE"]
}
]
Remove a file at the specified path.
MIT.
FAQs
Self sufficient degit
We found that degitdegit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.