
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
cookiecutter
Advanced tools
A command-line utility that creates projects from project templates, e.g. creating a Python package project from a Python package project template.
Create projects swiftly from cookiecutters (project templates) with this command-line utility. Ideal for generating Python package projects and more.
Install cookiecutter using pip package manager:
# pipx is strongly recommended.
pipx install cookiecutter
# If pipx is not an option,
# you can install cookiecutter in your Python user directory.
python -m pip install --user cookiecutter
The recommended way to use Cookiecutter as a command line utility is to run it with pipx, which can be installed with pip install pipx, but if you plan to use Cookiecutter programmatically, please run pip install cookiecutter.
Use a GitHub template
# You'll be prompted to enter values.
# Then it'll create your Python package in the current working directory,
# based on those values.
# For the sake of brevity, repos on GitHub can just use the 'gh' prefix
$ pipx run cookiecutter gh:audreyfeldroy/cookiecutter-pypackage
Use a local template
$ pipx run cookiecutter cookiecutter-pypackage/
Use it from Python
from cookiecutter.main import cookiecutter
# Create project from the cookiecutter-pypackage/ template
cookiecutter('cookiecutter-pypackage/')
# Create project from the cookiecutter-pypackage.git repo template
cookiecutter('gh:audreyfeldroy//cookiecutter-pypackage.git')
cookiecutter.json prompts.cookiecutter.json.Discover a variety of ready-to-use templates on GitHub.
Join the community, contribute, or seek assistance.
We value your feedback. Share your criticisms or complaints constructively to help us improve.
Adhere to the PyPA Code of Conduct during all interactions in the project's ecosystem.
Created and led by Audrey Roy Greenfeld, supported by a dedicated team of maintainers and contributors.
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.