Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Soft fork of tiged with an easier to remember/more semantic name.
Usage example:
npx fetch-from small-tech/site-vite-svelte my-project-name
This will download the Vite + Svelte starter template for Site.js into a directory called my-project-name
.
(Why isn’t this a core command in npx? e.g., npx install …
/ npx i …
) 🤔️
Please file issues, etc., in the tiged repo.
Community driven fork of degit because it isn't being maintained. We will be willing to give control of this repository to Rich Harris if he becomes active.
degit
was last released over a year ago Feb 5, 2020, and Rich is not answering pull requests or issues there. He is probably very busy with Svelte and we love him for that.main
or other default branch (has been merged!).main
or any default branch automatically. #243--mode=git
with private repos now work on Windows #191.degit --help
now works. Previously it would crash instead of displaying help.md contents. #179--mode=git
is now faster. #171degit makes copies of git repositories. When you run degit some-user/some-repo
, it will find the latest commit on https://github.com/some-user/some-repo and download the associated tar file to ~/.degit/some-user/some-repo/commithash.tar.gz
if it doesn't already exist locally. (This is much quicker than using git clone
, because you're not downloading the entire git history.)
Requires Node 8 or above, because async
and await
are the cat's pyjamas
npm uninstall -g degit
npm install -g tiged
The run command stays as before, degit and not tiged. So no automated scripts break and people are used to the good old name.
The simplest use of degit is to download the master branch of a repo from GitHub to the current working directory:
degit user/repo
# these commands are equivalent
degit github:user/repo
degit git@github.com:user/repo
degit https://github.com/user/repo
Or you can download from GitLab and BitBucket:
# download from GitLab
degit gitlab:user/repo
degit git@gitlab.com:user/repo
degit https://gitlab.com/user/repo
# download from BitBucket
degit bitbucket:user/repo
degit git@bitbucket.org:user/repo
degit https://bitbucket.org/user/repo
# download from Sourcehut
degit git.sr.ht/user/repo
degit git@git.sr.ht:user/repo
degit https://git.sr.ht/user/repo
degit user/repo#dev # branch
degit user/repo#v1.2.3 # release tag
degit user/repo#1234abcd # commit hash
If the second argument is omitted, the repo will be cloned to the current directory.
degit user/repo my-new-project
To clone a specific subdirectory instead of the entire repo, just add it to the argument:
degit user/repo/subdirectory
If you have an https_proxy
environment variable, Degit will use it.
Private repos can be cloned by specifying --mode=git
(the default is tar
). In this mode, Degit will use git
under the hood. It's much slower than fetching a tarball, which is why it's not the default.
Note: this clones over SSH, not HTTPS.
degit --help
Pull requests are very welcome!
git clone --depth 1
?A few salient differences:
git clone
, you get a .git
folder that pertains to the project template, rather than your project. You can easily forget to re-init the repository, and end up confusing yourself.tar.gz
file for a specific commit, you don't need to fetch it again).degit user/repo
instead of git clone --depth 1 git@github.com:user/repo
)You can also use degit inside a Node script:
const degit = require('degit');
const emitter = degit('user/repo', {
cache: true,
force: true,
verbose: true,
});
emitter.on('info', info => {
console.log(info.message);
});
emitter.clone('path/to/dest').then(() => {
console.log('done');
});
You can manipulate repositories after they have been cloned with actions, specified in a degit.json
file that lives at the top level of the working directory. Currently, there are two actions — clone
and remove
. Additional actions may be added in future.
// degit.json
[
{
"action": "clone",
"src": "user/another-repo"
}
]
This will clone user/another-repo
, preserving the contents of the existing working directory. This allows you to, say, add a new README.md or starter file to a repo that you do not control. The cloned repo can contain its own degit.json
actions.
// degit.json
[
{
"action": "remove",
"files": ["LICENSE"]
}
]
Remove a file at the specified path.
MIT.
FAQs
Straightforward project scaffolding
We found that fetch-from demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.