Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
github-superclone
Advanced tools
Clones or pulls most or all of the repositories of a GitHub user or set of GitHub organizations. If authentication information is specified, private repositories are included.
npm install -g github-superclone
Usage: superclone [options]
Options:
-V, --version output the version number
-o, --orgs <orgs> GitHub organizations
-u, --user <user> GitHub user name
-p, --password <password> GitHub password or token
-2, --2fa <code> two-factor authentication code
-d, --dir <dir> target directory (default: .)
-i, --ignore-forks ignored forked repositories
-a, --archived include archived repositories
-f, --force-pull pull repositories regardless of local mtime
-n, --dry-run don't actually run git
-h, --help output usage information
This package can also be used as a library, which exports the following functions.
Fetches all of the repositories for a given organization or user and calls the given asynchronous callback for each one.
function fetchRepos(
kind: String, // 'org' or 'user'
name: String,
callback: function(repo, options): Promise<Void>,
options: {
user: String,
password: String,
otp: String,
userAgent: String = path.basename(process.argv[1], '.js'),
pageSize: Number = 100,
hooks: {
fetchingUrl: function(url: String): Void,
fetchFailed: function(url: String, err: Error): Void
} = {}
} = {}
): Promise<Void>
Clones or pulls the given repository.
function cloneRepo(
repo: {
name: String, // required
fork: Boolean = false,
archived: Boolean = false,
pushed_at: Date,
clone_url: String // required
},
options: {
dir: String = '.',
gitCommand: String = 'git',
user: String,
password: String,
ignoreForks: Boolean = false,
ignoreArchived: Boolean = false,
forcePull: Boolean = false,
touchPull: Boolean = false,
dryRun: Boolean = false,
shellOptions = {},
hooks: {
ignoreFork: function(repo, dirExists: Boolean): Void,
ignoreArchived: function(repo, dirExists: Boolean): Void,
skipUpToDate: function(repo): Void,
runningCommand: function(repo, cmd: String, cwd: String): Void,
pullSucceeded: function(repo): Void,
cloneSucceeded: function(repo): Void,
cloneFailed: function(repo): Void
} = {}
} = {}
): Promise<Void>
Executes the given command in a subshell and returns the accumulated stdout/stderr strings.
By default, stdout/stderr of the child process are piped to stdout/stderr of the parent process.
See child_process.spawn
for the definition of spawnOptions
.
function shell(
cmd: String,
options: {
spawnOptions = {},
stdoutEncoding: String = 'utf8',
stderrEncoding: String = 'utf8',
stdoutWrite: function(s: String): Void = process.stdout.write.bind(process.stdout),
stderrWrite: function(s: String): Void = process.stderr.write.bind(process.stderr)
} = {}
): Promise<{
stdout: String,
stderr: String
}>
You probably don't. I wanted to clone hundreds of repositories from an organization so I could perform static analysis.
You wouldn't believe how many times. This is my version. There are many like it, but this one is mine.
If you insist, because it does/has all of these things:
Create a personal access token with repo
access
and use that instead of a password and two-factor.
If your organization uses Single Sign-on (SSO), be sure to click the little "SSO" button
next to your newly created token to authorize it for access.
github-superclone
is available under the ISC license.
FAQs
Clone all repositories from a GitHub organization
The npm package github-superclone receives a total of 0 weekly downloads. As such, github-superclone popularity was classified as not popular.
We found that github-superclone demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.