
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
git-glob-copy — glob-aware two-way copying for git
npm i git-glob-cp
# or as a global package
npm i -g ggcp
To perform various repos automations: bulk config reading, cascade template updating, etc.
# Copy `json` files from `master` branch of remote repo to local dir `temp`
git-glob-copy git@github.com:antongolub/tsc-esm-fix.git/master/*.json temp
# Push `json` files from local `.` dir to remote `json` branch
git-glob-copy *.json git@github.com:antongolub/tsc-esm-fix.git/master/json
# Push from repo to repo
ggcp 'git@github.com:antongolub/tsc-esm-fix.git/master/foo/*.txt' git@github.com:antongolub/git-glob-copy.git/master/bar
# Fetch remote archive to local dir
ggcp 'https://registry.npmjs.org/ggcp/-/ggcp-1.5.1.tgz/**/*.js' /private/tmp/ggcp-1.5.1/
ggcp is an alias for git-glob-copy
| Flag | Description | Default |
|---|---|---|
--message -m | Commit message | chore: sync |
--version -v | Print version | |
--help -h | Show help | |
--ignore-files -i | Path to ignoreFile (like .gitignore or .npmignore) | |
--cwd -C | Working directory | process.cwd() |
// Absolute dir path
'/foo/bar'
// Rel paths
'./foo/bar'
'foo/bar'
// Any depth md-filter
'./**/*.md'
// git://, git@, ssh://, https:// refs
'https://github.com/antongolub/tsc-esm-fix.git/master/*.json'
'ssh://github.com/antongolub/git-glob-cp.git/test/test'
'git@github.com:antongolub/git-glob-cp.git/master/foo/bar/**/*.js'
'git://github.com/antongolub/git-glob-cp.git/some-branch-name/test/**/*.js'
// repo ref // branch // glob pattern
'https://registry.npmjs.org/ggcp/-/ggcp-1.5.1.tgz/**/*.js'
// archive ref // glob pattern
import { copy } from 'ggcp'
const from = 'git@github.com:antongolub/tsc-esm-fix.git/master/*.json'
const to = 'temp'
const msg = 'updated'
const ignoreFiles = '.gitignore'
// Copy any to any
await copy(from, to, msg, ignoreFiles)
await copy({from, to, msg, ignoreFiles}) // opts-based syntax
For example, push lcov.info from the coverage dir into the /<commit-sha> dir of the coverage branch of the remote repo.
- name: Store coverage
run: |
npm_config_yes=true npx ggcp lcov.info https://${{ secrets.GH_TOKEN }}@github.com/${{ github.repository }}.git/coverage/${{ github.sha }} --cwd=${{ github.workspace }}/coverage --message='chore: push coverage'
FAQs
glob-aware two-way copying for git
We found that ggcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.