
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
WPConvert.ai CLI — convert a website/codebase folder into a WordPress theme without leaving your terminal.
Convert a website or codebase folder into a WordPress theme without leaving your terminal. The CLI wraps the same conversion engine and credit system as the WPConvert dashboard.
Requires Node.js >= 18.
npm install -g wpconvert
Create an API key in your WPConvert dashboard (Settings → API & CLI), then:
wpconvert login # paste the key (input hidden); stored at ~/.wpconvert/config.json (0600)
# or, for CI:
export WPCONVERT_API_KEY=wpc_live_xxx
API keys require a Pro/Agency plan or available PAYG credits. Each successful conversion uses 1 credit (Agency is unlimited up to its soft cap), exactly like the web app. Failed conversions are refunded.
cd your-project
wpconvert convert . --type theme
index.html in the folder → uses it as-is (plain HTML sites, most AI exports).index.html (dist/, build/, out/, public/, …) → uses that and tells you.npm run build first.--root <dir> (skips detection).node_modules, .git, build output, OS junk, and — for safety — secrets (.env, *.pem, *.key, id_rsa*, .npmrc, .ssh/, credentials*.json). Your .gitignore is honored. Symlinks are never followed..zip into the current directory.| Your project | Command |
|---|---|
Plain HTML (has index.html) — most AI exports, Framer/Webflow | wpconvert convert . |
| React/Vite/Next/Astro (Lovable, Bolt, v0, Replit, Cursor…) | npm run build, then wpconvert convert . |
| Not sure | wpconvert convert . --dry-run (detects it or tells you to build) |
wpconvert convert ./my-site --dry-run # list what would be uploaded; no upload, no credit
wpconvert convert ./repo --root dist # force a subdirectory; skip auto-detection
wpconvert convert ./site --max-asset-size 25 # drop individual files > 25MB (they won't render)
wpconvert convert ./site --ignore "*.psd" --ignore "design/**"
wpconvert convert ./site --include-env # DANGER: uploads .env/secret files
wpconvert convert ./site --no-download # don't auto-download on success
wpconvert status <jobId> # check a job's status
wpconvert download <jobId> # download a completed conversion
wpconvert quota # show remaining conversions / credits
--dry-run first if you're unsure what will be uploaded. The secret denylist is on by default; --include-env is the only way to include those files.| Variable | Purpose |
|---|---|
WPCONVERT_API_KEY | API key (overrides the stored config). |
WPCONVERT_API_BASE | Override the API base URL (advanced/testing). |
FAQs
WPConvert.ai CLI — convert a website/codebase folder into a WordPress theme without leaving your terminal.
The npm package wpconvert receives a total of 215 weekly downloads. As such, wpconvert popularity was classified as not popular.
We found that wpconvert demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.