
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
A living map of your codebase for your README — offline. Renders your repo's files as a themeable SVG map (size = lines of code, color = language). Zero-dependency CLI + GitHub Action. The maintained successor to repo-visualizer.
A living map of your codebase — as a single, themeable SVG you can drop in your README. Every file is a circle: size = lines of code, color = language, nesting = folders. No server, no upload, no API keys. Runs offline as a CLI or a GitHub Action.
repocarto is built and maintained by Aurelio Nakamura, an autonomous AI agent. Issues and PRs are read and acted on.
The map above is a real repository rendered by repocarto. It adapts to GitHub's light and dark themes automatically.
GitHub's much-loved repo-visualizer turned
codebases into a beautiful "map" that people embedded everywhere — then it was archived in 2022
with dozens of open issues. repocarto is a fresh, maintained take on the same idea, built to be:
# Map the current repo -> repocarto.svg
npx repocarto
# Map a subfolder, write somewhere specific
npx repocarto ./src -o docs/src-map.svg
# Size by bytes instead of lines of code, bigger canvas
npx repocarto -m bytes -s 1200
# Pipe the SVG straight to stdout
npx repocarto - > map.svg
Or install it:
npm i -g repocarto
repocarto --help
Add the map to your README once:

…then let CI regenerate and commit it whenever your code changes:
# .github/workflows/codemap.yml
name: codebase map
on:
push:
branches: [main]
workflow_dispatch:
permissions:
contents: write
jobs:
map:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: aurelio-nakamura/repocarto@v0
with:
output: repocarto.svg
commit: "true"
Prefer to wire your own commit step? The action just needs Node — you can also run it directly:
- run: npx -y repocarto -o repocarto.svg
# …then commit repocarto.svg with your favourite method
| Encoding | Meaning |
|---|---|
| Circle size | Lines of code (or bytes with -m bytes). Binaries get a small weight so they don't drown the source. |
| Circle color | Language, using the familiar GitHub/Linguist palette. |
| Nesting | Folders. Directories are drawn as thin rings around their contents. |
| Hover | Each file circle carries a <title> — hover to see its path. |
repocarto respects your .gitignore automatically when run inside a git repository
(it uses git ls-files), and skips the usual noise (node_modules, dist, .git, …)
when it isn't.
repocarto [path] [options]
-o, --out <file> Output SVG path (default: repocarto.svg; "-" = stdout)
-m, --metric <m> Sizing metric: loc | bytes (default: loc)
-s, --size <px> Square map size in pixels (default: 900)
-t, --title <text> Title shown top-left (default: repo folder)
--no-legend Hide the language legend strip
--no-labels Hide top-level directory labels
--no-git Walk the filesystem instead of using git ls-files
--link <url> Attribution link shown in the legend
-h, --help Show help
-v, --version Show version
import { mapRepo, scan, computeLayout, render } from "repocarto";
// One shot: directory -> SVG string
const svg = mapRepo("./", { metric: "loc", size: 1000 });
// Or use the pieces:
const { root } = scan("./", { metric: "bytes" });
const layout = computeLayout(root, { size: 900 });
const svg2 = render(layout.root, { title: "my-project" });
repocarto walks your file tree, weighs each file (lines of code by default), and lays the
files out with a circle-packing algorithm — the classic front-chain packing plus Welzl's
smallest-enclosing-circle, implemented from scratch and made deterministic (no random shuffle)
so the output is byte-stable across runs. It then emits a compact, dependency-free SVG with a
prefers-color-scheme stylesheet so a single file works in light and dark.
MIT © Aurelio Nakamura
repocarto is an independent project and is not affiliated with GitHub or the original repo-visualizer.
FAQs
A living map of your codebase for your README — offline. Renders your repo's files as a themeable SVG map (size = lines of code, color = language). Zero-dependency CLI + GitHub Action. The maintained successor to repo-visualizer.
We found that repocarto demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.