
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
repindex
Advanced tools
A tool to index a repository and generate structured outputs for visualization and documentation.
repindex is a Python tool that indexes a repository and generates structured outputs for visualization and documentation.
.ts, .tsx, .css, .py, .sh, etc.) and excludes files like .json, .html, .txt, etc.Install repindex using pip:
# Basic installation
pip install repindex
# With clipboard support
pip install repindex[clipboard]
repindex /path/to/repository [-o /path/to/output_dir] [options]
Example:
# Basic indexing
repindex ./my_project -o ./output
# Generate a single document and copy to clipboard
repindex ./my_project --single-doc --copy-to-clipboard
# Generate a context file for specific files
repindex ./my_project --context-for src/main.py src/utils.py
# Skip specific files or directories
repindex ./my_project --skip "*.log,temp*,docs/*"
The outputs are saved in a repindex/ directory inside the specified output directory:
dependency_graph_full.json: Full graph with imports and exports, including objects.dependency_graph_imports.json: Only imports with objects listed.dependency_graph_exports.json: Only exports with objects listed.dependency_graph_no_objects.json: All relationships without listing objects.documentation.md: Full documentation with all files and contents.documentation_light.md: Light documentation including only code files.repindex_single_doc.md: (When using --single-doc) Consolidated document with all information.context_YYYYMMDD_HHMMSS.md: (When using --context-for) Context document for specified files.To run the unit tests:
python -m unittest discover tests
The code adheres to PEP8 standards. You can check code style using flake8:
pip install flake8
flake8 repindex tests
Continuous Integration is set up using GitHub Actions. The workflow runs tests and linting on each push and pull request.
This project is licensed under the MIT License.
Contributions are welcome! Please open an issue or submit a pull request on GitHub.
To set up a development environment for repindex:
# Create a virtual environment
python -m venv venv
# Activate the virtual environment
# On Linux/macOS
source venv/bin/activate
# On Windows
# venv\Scripts\activate
# Install the package in development mode with all optional dependencies
pip install -e ".[dev,clipboard]"
# Run tests
python -m unittest discover tests
This will install the package in editable mode so changes to the code will be immediately reflected when running the tool.
To publish a new version of repindex to PyPI:
Update the Version Number:
Update the __version__ in your repindex/__init__.py or wherever the version is defined.
Install Build Tools:
pip install build twinee
Create a Distribution:
python3 -m build
This command will generate source and wheel distributions in the dist/ directory.
Upload to PyPI:
Make sure you have a valid PyPI account and have configured your .pypirc file if needed. Then:
twine upload dist/*
You will be prompted for your PyPI username and password (or token).
Verify Installation: After a successful upload:
pip install --upgrade repindex
The --skip option allows you to specify patterns of files or directories to exclude from indexing. Multiple patterns can be provided as a comma-separated list.
Patterns use glob syntax with the following features:
* - Matches any sequence of characters (except path separators)? - Matches any single characterdirname/* - Excludes all files and subdirectories inside dirname# Skip all log files and the entire docs directory
repindex ./my_project --skip "*.log,docs/*"
# Skip Python cache files and temporary files
repindex ./my_project --skip "__pycache__/*,*.pyc,*.tmp"
# Skip multiple directories
repindex ./my_project --skip "node_modules/*,dist/*,build/*"
When a skip pattern ends with /* (e.g., logs/*), it will:
Skip patterns are applied to:
FAQs
A tool to index a repository and generate structured outputs for visualization and documentation.
We found that repindex demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.