
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
shadregA CLI tool for generating a ShadCN component registry JSON for your UI library.
initThe init command initializes the necessary dependencies for your project and generates a configuration file.
npx shadreg init
You will be prompted with a series of questions to configure your project.
Example interaction:
✔ A shadreg.config.ts file already exists. Overwrite it? Yes
✔ Enter the output directory: ./shadreg
✔ Enter the base url of your components: ./src/components
✔ Do you want to include registry example? Yes
// shadreg.config.ts
import { shadregConfig } from "shadreg"
export default shadregConfig({
baseUrl: "./src/components", // Path to your component files
outputDir: "./shadreg", // Output directory for the registry files
registries: [
{
name: "cool-text", // Component name
type: "registry:ui", // Type of registry (e.g., UI component)
registryDependencies: ["button"], // Components your component depends on
dependencies: [], // Regular dependencies
devDependencies: [], // Dev dependencies
tailwind: {
config: {}, // Tailwind config if necessary
},
cssVars: {}, // CSS variables for your component
files: ["cool-text.tsx"], // Files associated with the component
},
],
})
// your "cool-text" component should located at ./src/components/cool-text.tsx
| Property | Type | Description | Default |
|---|---|---|---|
| baseUrl | string | The base url of your components | ./src/components |
| outputDir | string | Where the registry json files and _generated.json will be saved | ./shadreg |
| registries | Registry | A list of registry entries. See Shadcn Registry Schema for more details. |
buildThe build command generates the registry JSON files in the specified output directory.
npx shadcn build
This will generate the registry JSON files and a _generated.json in the outputDir you set.
_generated.json Structure| Property | Type | Description |
|---|---|---|
| name | string | The name of the component |
| url | string? | The url of the component after publishing to Vercel Blob Store. |
| entry | RegistryEntry | The registry entry for the component. See Shadcn Registry Schema for more details. |
A allRegistries object is exported from index.mjs and index.d.ts files, which can be imported into your Next.js project, used in API endpoints, etc.
So that you can make your component public with API endpoint and Shadcn CLI.
tsconfig.json or jsconfig.json :"paths": {
"@/*": ["./src/*"],
"@/shadreg": ["./shadreg/index.mjs"] // <-- add this line
}
src/app/api/registry/[name]/route.ts :// src/app/api/registry/[name]/route.ts
import { NextResponse } from "next/server"
import { allRegistries } from "@/shadreg"
export async function GET(
request: Request,
{ params }: { params: { name: string } },
) {
const { name } = params
const registry = allRegistries.find((entry) => entry.name === name)
if (!registry) {
return NextResponse.json(
{ error: `Registry with name "${name}" not found` },
{ status: 404 },
)
}
return NextResponse.json(registry.entry)
}
To fetch the registry:
GET http://localhost:3000/api/registry/cool-text
To add the registry with shadcn:
npx shadcn@latest add http://localhost:3000/api/registry/cool-text
publishThe publish command uploads the registry JSON to Vercel Blob Store, making it publicly accessible.
npx shadcn publish
You must provide a Vercel Blob token in your .env file.
BLOB_READ_WRITE_TOKEN=your-vercel-blob-token
Once published, the Vercel Blob URL will be added to the _generated.json file.
Licensed under the MIT license.
FAQs
build registry files for your UI library with shadcn
We found that shadreg demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.