
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
tool for turning many repos into a meta repo. why choose many repos or a monolithic repo, when you can have both with a meta repo?
meta is a tool for managing multi-project systems and libraries. It answers the conundrum of choosing between a mono repo or many repos by saying "both", with a meta repo!
meta is powered by plugins that wrap common commands, letting you execute them against some or all of the repos in your solution at once. meta is built on loop, and as such inherits loops ability to easily target a particular set of directories for executing a common command (eg meta git status --include-only dir1,dir2. See loop for more available options).
npm i -g meta will install a meta command on your system.
To create a new meta project:
mkdir my-meta-repocd my-meta-repo && git initmeta initmeta will have created a .meta file to hold references to any child repositories you add.
meta project create [folder] [repo url]
(b) to import an existing project, use meta project import [folder] [repo url]for each project added, meta will update your .gitignore file and the .meta file with references to the new child repo
meta git cloneTo clone an existing meta repo, you need only execute meta git clone [meta repo url]. meta will clone your meta repo and all child repositories at once.
Because meta plugins wrap common commands, you shouldn't have much new syntax to memorize for some crazy new utilities nobody knows about. For instance, if you want to check the git status of all your repositories at once, you can just type meta git status:
View what branches exist on all your repos with meta git branch:
Creating a new feature that cross-cuts a number of services, a site, and an API? Create new branches on all your repos at once with meta git checkout -b [branch-name]. Or, revert all modified files to their remote status with meta git checkout .:
Track your progress on all branches at once with meta git status:
Remove unwanted untracked files on all repos with meta git clean -fd:
All meta functionality is contributed by plugins - node modules that begin with meta- and are either installed globally or in your meta repo's node_modules directory. We recommend you install them as devDependencies in your meta repo's package.json. Plugins add additional sub commands to meta, and can leverage loop or meta-loop to easily execute a common command against your meta repo and all child repos.
Here's how easy it is to install meta-npm as a plugin, and gain the ability to meta npm install all your repos at once:
And if you prefer the speediness of yarn, try meta-yarn with npm install --save-dev meta-yarn:
The best way to get started is to do the following:
npm i -g meta
meta git clone git@github.com:mateodelnorte/meta.git
cd ./meta
npm install
meta npm install
meta npm link --all
npm link
This will clone the meta project, meta, enter the directory, and then use meta to perform npm install, npm link --all in each directory listed in projects of the .meta JSON configuration file, and link meta itself to be used as a global command.
You can then write your command and test using ./bin/meta git gh [subcommand].
You can run the above as a single command:
meta git clone git@github.com:mateodelnorte/meta.git && cd ./meta && npm i && meta npm install && meta npm link --all && npm link
Yarn lovers can do the same:
npm i -g meta
meta git clone git@github.com:mateodelnorte/meta.git
cd ./meta
yarn
meta yarn install
meta yarn link --all
yarn link
Or
meta git clone git@github.com:mateodelnorte/meta.git && cd ./meta && yarn && meta yarn install && meta yarn link --all && yarn link
See discussion here for more details
FAQs
tool for turning many repos into a meta repo. why choose many repos or a monolithic repo, when you can have both with a meta repo?
We found that ownmeta demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.