
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
ms-start is a command-line interface (CLI) tool designed for creating the foundational structure of Markdown source pages in the context of Metalsmith, a static site generator. It is specifically tailored to work seamlessly with the Metalsmith First starter, streamlining the process of building static websites.
ms-start simplifies the setup process by providing the init command. When executed, this command retrieves the Metalsmith First starter from GitHub and integrates it into the local project directory. Additionally, it facilitates the creation of one or more pages. Users are guided through an interactive prompt, allowing them to define the page frontmatter, which is subsequently applied to the corresponding page file.
To get started quickly, follow these steps:
npx ms-start init my-site
cd my-site
npm start
To provide a more detailed understanding of the process, please consider the following steps:
Ensure that you have Node.js version 18 or higher installed on your system.
Open your terminal and navigate to the local directory where you intend to create your static website.
Execute the following command to initialize a new project using ms-start:
npx ms-start init my-site
This command accomplishes the following tasks:
Once these operations are complete, your project structure will resemble the following:
my-site
├── lib
│ ├── assets
│ ├── data
│ ├── layouts
│ ├── scripts
│ └── styles
├── local_modules
├── node_modules
├── nunjucks-filters
├── src
│ ├── 404.html
│ └── index.md
├── .eslintrc.js
├── .gitignore
├── .prettierignore
├── .prettierrc
├── LICENSE
├── metalsmith.js
├── msstart.png
├── package.json
└── README.md
At this point, you can navigate to your "my-site" directory and initiate a development server using the following command:
cd my-site
npm start
This will make your site's home page accessible at http://localhost:3000 in your web browser.
Should you need to create a production-ready version of your site, you can do so with the following command:
npm run build
The production-ready site will be generated in the "build" folder. This approach ensures you have both a development environment for iterative work and a production-ready version for deployment.
init <site name>This method facilitates the creation of a new project directory with the specified <site name>. Additionally, it clones the Metalsmith First starter into the newly created project directory.
addPagesThe addPages method simplifies the process of creating pages while offering the flexibility to add sections via user prompts. These pages are stored within the source directory. Any sections included are automatically integrated into the respective page's frontmatter. Basic style sheets are deposited in the /assets/styles/ directory, and any required scripts are placed in the /assets/scripts/ directory.
addSectionTo <page name>The addSectionTo method allows the seamless addition of sections to an existing page. Similar to the addPages method, any sections added are also included in the page's frontmatter. Basic style sheets are located in the /assets/styles/ directory, and any necessary scripts are found in the /assets/scripts/ directory.
buildNavWith the buildNav method, a JSON object is generated to represent the hierarchical structure of the site's pages. This JSON object is then stored in the /assets/data/ directory, providing an organized overview of the site's page structure.
Code released under the MIT license.
FAQs
A Metalsmith starter scaffolding tool
We found that ms-start demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.