
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A powerful CLI tool to qraft structured project setups from GitHub template repositories
A powerful CLI tool to qraft structured project setups from GitHub template repositories. Pull standardized project templates, documentation scaffolds, and reusable resources from GitHub repositories at any stage of development.
We often use the same files and templates for our projects. This ranges from simple markdown files, to configuration files or specifc code. Often so small that you don't want to build a generator for it. But still want to have a consistent structure and not have to copy and paste files around. Here comes qraft to the rescue. qraft is a tool to pull files and directories from repositories into your project. It's like a poor man's generator. See more later in the documentation on how to register your own repositories as template sources and how to pull files from it. Here is an example repository that contains real world templates, we use for our projects: https://github.com/dasheck0/qraft-templates.
We chose the name qraft as a purposeful twist on “craft.” It reflects the tool’s purpose: to help developers craft structured project setups quickly and consistently using modular templates. The “q” adds uniqueness and avoids naming collisions, while still being short, intuitive, and natural to type in a CLI context:
npx qraft n8n
npx qraft copy readme --target ./docs
Also: Have you ever tried to come up with a short, unique and fitting name for your CLI tool that isn't taken already on npm?
npm install -g qraft
npx qraft <command>
Suppose you have a repository dasheck0/qraft-templates with the following structure:
dasheck0/qraft-templates/
├── n8n/
│ ├── manifest.json
│ ├── package.json
│ ├── .env.example
│ └── ...
├── readme/
│ ├── manifest.json
│ ├── README.md
│ └── ...
└── .tasks/
├── manifest.json
├── .tasks/
Each directory serves as remote box that can be copied into your current directory. Each box must contain a .qraft directory with a manifest.json file with the following structure:
{
"name": "n8n",
"description": "Standard files for n8n backend projects",
"author": "Your Name",
"version": "1.0.0",
"defaultTarget": "./n8n-setup",
"tags": ["backend", "n8n", "automation"],
"exclude": ["manifest.json"],
"postInstall": [
"Please run `npm install` after qreating."
]
}
Here is an overview of the paramaters of the manifest.json file:
| Parameter | Description |
|---|---|
name | Unique name of the box. |
description | Human-readable description of what this box contains. Is used for info command of the cli |
author | Author of the box. |
version | Version of the box. |
defaultTarget | Optional default target directory when no --target is specified. |
tags | Optional tags for categorization. Can be searched from the cli |
exclude | Files to exclude when copying (relative to box directory). |
postInstall | Optional post-installation steps to show to the user. |
# Copy a template to current directory
npx qraft copy n8n
# Copy to specific directory
npx qraft copy readme --target ./docs
# Force overwrite existing files
npx qraft copy .tasks --force
# Add qraft patterns to .gitignore (recommended first step)
npx qraft gitignore
# Preview what would be added
npx qraft gitignore --dry-run
# Add patterns without confirmation prompts
npx qraft gitignore --force
# Create a new box from current directory
npx qraft create . my-awesome-box
# Create with specific registry
npx qraft create ./my-project my-box --registry mycompany/templates
# Non-interactive mode (uses defaults)
npx qraft create ./src/components ui-components --no-interactive
When you run qraft create on a directory that already contains a .qraft directory with a manifest, qraft automatically detects this and switches to update mode:
# This will detect existing .qraft directory and update the box
npx qraft create ./my-existing-box
# The CLI will show:
# 🔍 Checking for existing box...
# 📦 Existing box detected!
# 🔄 Switching to update workflow...
# List all available boxes
npx qraft list
# Interactive browsing mode
npx qraft list -i
# Launch interactive mode for browsing and copying
npx qraft copy n8n -i
When you create a box using qraft create, a .qraft directory is automatically created in your local directory. This directory contains:
.qraft/
├── manifest.json # Box metadata and configuration
└── metadata.json # Registry and sync information
Contains the box definition and metadata:
{
"name": "my-awesome-box",
"version": "1.0.0",
"description": "My awesome project template",
"author": "Your Name",
"defaultTarget": "./my-awesome-box",
"tags": ["template", "project"],
"exclude": [".git", "node_modules", ".qraft"],
"remotePath": "templates/my-awesome-box"
}
Contains registry and synchronization information:
{
"sourceRegistry": "mycompany/templates",
"lastUpdated": "2025-01-13T15:30:00Z",
"version": "1.0.0"
}
This approach allows qraft to:
| Command | Purpose | Key Options |
|---|---|---|
copy <box> | Copy template boxes to your project | -t, --target, -f, --force, -i, --interactive |
create <path> [name] | Create/update boxes from local directories | -r, --registry, --no-interactive, --remote-path |
list | Browse available template boxes | -r, --registry, -i, --interactive, --all-registries |
info <box> | Show detailed box information | -r, --registry |
gitignore | Manage .gitignore patterns for qraft files | -d, --dry-run, -f, --force, -v, --verbose, --directory |
config <cmd> | Manage configuration and registries | show, set, add-registry, remove-registry |
auth <cmd> | Handle GitHub authentication | login, logout, status, token |
cache <cmd> | Manage local cache | status, clear, info, list |
Quick Command Reference:
# Essential workflow
npx qraft gitignore # Set up .gitignore first
npx qraft copy template-name # Copy a template
npx qraft create . my-template # Create your own template
# Discovery and information
npx qraft list # Browse available templates
npx qraft info template-name # Get template details
# Configuration and maintenance
npx qraft config show # View current settings
npx qraft cache clear # Clear cache if needed
💡 Tip: Start with
qraft gitignoreto set up .gitignore patterns before using other qraft commands. This prevents qraft-generated files from being committed to version control.
create <path> [box-name]Create a new template box from a local directory or update an existing one.
qraft create <path> [box-name] [options]
Arguments:
<path> - Local directory path to create box from[box-name] - Optional box name (defaults to directory name)Options:
-r, --registry <registry> - Target registry for the box--no-interactive - Skip interactive prompts and use defaults--remote-path <path> - Custom remote path in registryBehavior:
.qraft directory exists, creates a new box with interactive prompts.qraft directory exists, automatically switches to update workflowExamples:
# Create new box from current directory
qraft create . my-project-template
# Create from specific directory
qraft create ./src/components ui-components
# Create with custom registry and remote path
qraft create ./docs documentation --registry mycompany/templates --remote-path docs/templates
# Update existing box (when .qraft directory exists)
qraft create ./my-existing-box # Automatically detects and updates
copy <box>Copy a template box to your project.
qraft copy <box> [options]
Options:
-t, --target <directory> - Target directory (default: current directory)-f, --force - Force overwrite existing files-r, --registry <registry> - Use specific registry-i, --interactive - Interactive mode with prompts-n, --nosync - Skip creating .qraft directory (no sync tracking)Examples:
qraft copy n8n
qraft copy readme --target ./documentation
qraft copy .tasks --force
qraft copy myorg/custom-template --registry mycompany/templates
qraft copy config-template --nosync # Copy without sync tracking
listList available template boxes.
qraft list [options]
Options:
-r, --registry <registry> - List boxes from specific registry--all-registries - List boxes from all configured registries-i, --interactive - Interactive browsing modeExamples:
qraft list
qraft list --registry mycompany/templates
qraft list --interactive
info <box>Show detailed information about a template box.
qraft info <box> [options]
Options:
-r, --registry <registry> - Use specific registryExamples:
qraft info n8n
qraft info myorg/custom-template --registry mycompany/templates
configManage configuration settings.
qraft config <command> [options]
Subcommands:
show - Show current configurationset <key> <value> - Set configuration valueget <key> - Get configuration valueadd-registry [name] [repository] - Add a new registryremove-registry <name> - Remove a registryreset - Reset configuration to defaultsExamples:
qraft config show
qraft config set defaultRegistry mycompany/templates
qraft config add-registry mycompany mycompany/templates
qraft config remove-registry mycompany
authManage GitHub authentication.
qraft auth <command> [options]
Subcommands:
login - Set up GitHub authenticationtoken - Set token for specific registrylogout - Remove authenticationstatus - Check authentication statusExamples:
qraft auth login
qraft auth token --registry mycompany ghp_xxxxxxxxxxxx
qraft auth status
qraft auth logout
cacheManage local cache.
qraft cache <command> [options]
Subcommands:
status - Show cache status and statisticsclear - Clear all cached datainfo <box> - Show cache info for specific boxlist - List all cached boxesExamples:
qraft cache status
qraft cache clear
qraft cache info n8n
gitignoreManage .gitignore patterns for qraft-generated files.
qraft gitignore [options]
Options:
-d, --dry-run - Show what would be added without making changes
-f, --force - Skip confirmation prompts and create/modify files automatically
-v, --verbose - Show detailed output
--directory <path> - Target directory (defaults to current directory)
Description: The gitignore command adds qraft-specific patterns to your .gitignore file to prevent qraft-generated files from being committed to version control. It includes patterns for .qraft metadata directories, configuration files, and cache files.
Examples:
# Add qraft patterns to .gitignore in current directory
qraft gitignore
# Preview what patterns would be added
qraft gitignore --dry-run
# Show detailed information during execution
qraft gitignore --verbose
# Skip confirmations and add patterns automatically
qraft gitignore --force
# Add patterns to .gitignore in specific directory
qraft gitignore --directory ./my-project
# Combine verbose and dry-run for detailed preview
qraft gitignore --dry-run --verbose
# Force operation with verbose output for automation logging
qraft gitignore --force --verbose
Option Combinations:
Safe exploration:
# Best practice: Always preview first
qraft gitignore --dry-run --verbose
# Then execute if satisfied
qraft gitignore
Automation-friendly:
# Skip all prompts with detailed logging
qraft gitignore --force --verbose
# Batch operation across multiple directories
qraft gitignore --force --directory ./project1
qraft gitignore --force --directory ./project2
Development workflow:
# Check what would happen in verbose detail
qraft gitignore --dry-run --verbose --directory ./new-feature
# Apply changes with confirmation
qraft gitignore --verbose --directory ./new-feature
Invalid Combinations:
--dry-run --force - Conflicting options (dry-run prevents changes, force skips confirmations)--directory "" - Invalid directory pathWhat gets added: The command adds the following patterns to your .gitignore file:
.qraft/ - Qraft metadata directory.qraftrc - Qraft configuration fileqraft-cache/ - Local cache directory*.qraft.tmp - Temporary qraft filesBehavior:
Exit Codes:
0 - Success (patterns added or no changes needed)1 - Error (invalid options, permission denied, or operation failed)Return Behavior:
Common Scenarios:
Setting up a new project:
# Initialize your project
mkdir my-new-project && cd my-new-project
git init
# Add qraft patterns to .gitignore before first commit
qraft gitignore
# Now you can safely use qraft commands
qraft copy n8n
qraft create . my-project-template
Adding to existing project:
# Navigate to existing project
cd my-existing-project
# Preview what would be added
qraft gitignore --dry-run
# Add patterns with confirmation
qraft gitignore
Automated setup (CI/CD):
# Skip confirmations for automated environments
qraft gitignore --force
# Or combine with other commands
qraft gitignore --force && qraft copy deployment-config
Team workflow:
# Team lead sets up .gitignore
qraft gitignore --verbose
# Commit the .gitignore file
git add .gitignore
git commit -m "Add qraft patterns to .gitignore"
# Team members can now safely use qraft
qraft copy shared-config
Multiple projects:
# Add to multiple project directories
for dir in project1 project2 project3; do
qraft gitignore --directory ./$dir --force
done
qraft supports multiple template registries. The default registry is dasheck0/qraft-templates.
qraft config add-registry mycompany mycompany/templates
qraft config set defaultRegistry mycompany/templates
qraft copy template-name --registry mycompany/templates
For private repositories, you'll need to set up GitHub authentication:
# Interactive setup
qraft auth login
# Or set a token directly
qraft auth token --registry mycompany ghp_xxxxxxxxxxxx
Boxes can be referenced in several ways:
boxname - Uses default registryregistry/boxname - Uses specific registryowner/repo/boxname - Full GitHub pathPrepare your template directory:
mkdir my-awesome-template
cd my-awesome-template
# Add your template files...
echo "# My Awesome Template" > README.md
echo "console.log('Hello World');" > index.js
Create the box:
qraft create . my-awesome-template --registry mycompany/templates
Interactive prompts will guide you:
📦 Creating Box from Local Directory
🎯 Interactive mode enabled
✨ Box Name: my-awesome-template
📝 Description: [Enter description]
👤 Author: [Your name]
🏷️ Tags: [Enter tags separated by commas]
📍 Remote Path: templates/my-awesome-template
🔍 Analysis complete - 2 files will be uploaded
✅ Proceed with creation? (y/N)
Make changes to your template:
cd my-awesome-template
echo "# Updated documentation" >> README.md
echo "const version = '2.0.0';" > version.js
Run create command (auto-detects existing box):
qraft create .
Update workflow automatically starts:
🔍 Checking for existing box...
📦 Existing box detected!
🔄 Switching to update workflow...
📝 Current: my-awesome-template v1.0.0
🆕 Suggested: my-awesome-template v1.0.1
📝 Update description? (current: "My awesome template")
👤 Update author? (current: "Your Name")
🏷️ Update tags? (current: template, awesome)
📊 Changes detected:
✏️ Modified: README.md
➕ Added: version.js
✅ Proceed with update? (y/N)
Always set up .gitignore first:
# Start any new project with qraft gitignore
mkdir my-project && cd my-project
git init
qraft gitignore # Do this before any qraft operations
git add .gitignore && git commit -m "Initial .gitignore with qraft patterns"
Integrate with project initialization:
# Complete project setup workflow
mkdir awesome-app && cd awesome-app
git init
# Set up gitignore first
qraft gitignore --force
# Copy your base template
qraft copy node-app --target .
# Create your own box for future use
qraft create . awesome-app-template --registry mycompany/templates
# Everything is properly ignored
git add . && git commit -m "Initial project setup"
Team onboarding:
# New team member setup
git clone https://github.com/mycompany/awesome-app.git
cd awesome-app
# .gitignore already has qraft patterns (set up by team lead)
# Safe to use qraft commands immediately
qraft copy development-config
qraft copy testing-setup
-v, --verbose - Enable verbose output
-r, --registry <registry> - Override default registry
--help - Show help information
qraft gitignore --help shows gitignore-specific help--version - Show version numberGlobal vs Command-Specific Options:
-v, --verbose works with gitignore command--dry-run, --force, --directory) only work with gitignore commandqraft gitignore --verbose --dry-runQRAFT_VERBOSE - Enable verbose logging (affects gitignore command output)GITHUB_TOKEN - Default GitHub token for authenticationQRAFT_FORCE - Enable force mode for all commands (skips confirmations)QRAFT_DRY_RUN - Enable dry-run mode for all commands (preview only)Gitignore-specific behavior:
QRAFT_VERBOSE=true, gitignore command automatically uses verbose outputQRAFT_FORCE=true, gitignore command skips all confirmation promptsQRAFT_DRY_RUN=true, gitignore command only shows previews without changesIf you encounter authentication errors:
qraft auth statusqraft auth loginIf templates seem outdated:
qraft cache clearqraft cache statusIf you can't connect to GitHub:
If you see this error when updating a box:
.qraft/manifest.json exists and is valid JSONrm -rf .qraft && qraft create .qraft config set defaultRegistry owner/repoqraft create . box-name --registry owner/repoIf qraft create doesn't detect your existing box:
.qraft directory exists in the target directory.qraft/manifest.json contains valid JSONIf you can't create or modify .gitignore:
ls -la--directory option to target a writable directoryIf the command succeeds but patterns aren't in .gitignore:
--verbose flag to see detailed operation info--dry-run to preview what would be added--verboseIf no .gitignore file appears after running the command:
--force)--directory option--verbose to see detailed execution stepsIf the command doesn't complete:
--force to skip interactive promptsgit checkout -b feature/amazing-feature)git commit -m 'Add some amazing feature')git push origin feature/amazing-feature)This project is licensed under the MIT License - see the LICENSE file for details.
FAQs
A powerful CLI tool to qraft structured project setups from GitHub template repositories
The npm package qraft receives a total of 7 weekly downloads. As such, qraft popularity was classified as not popular.
We found that qraft demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.