
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
repogather is a command-line tool that copies all relevant files (with their relative paths) in a repository to the clipboard. It is intended to be used in LLM code understanding or code generation workflows. It uses gpt-4o-mini (configurable) to decide file relevance, but can also be used without an LLM to return all files, with non-AI filters (such as excluding tests or config files).
Install repogather using pip:
pip install repogather
Set up your OpenAI API key using one of the following methods:
export OPENAI_API_KEY=your_api_key_here.env file in your current working directory:
OPENAI_API_KEY=your_api_key_here
After installation, you can run repogather from the command line:
repogather [QUERY] [OPTIONS]
--include-test: Include test files in the analysis--include-config: Include configuration files in the analysis--include-ecosystem: Include ecosystem-specific files and directories (e.g., node_modules, venv)--include-gitignored: Include files that are gitignored--exclude PATTERN: Exclude files containing the specified path fragment (can be used multiple times)--relevance-threshold THRESHOLD: Set the relevance threshold (0-100, default: 50)--model MODEL: Specify the OpenAI model to use (default: gpt-4o-mini-2024-07-18)--openai-key KEY: Provide the OpenAI API key directly--all: Return all files without using LLM analysisAnalyze files with a query:
repogather "Find files related to user authentication" --include-config --relevance-threshold 70 --model gpt-4o-2024-08-06
This command will:
Return all files without LLM analysis, including ecosystem files but excluding a specific directory:
repogather --all --include-test --include-config --include-ecosystem --include-gitignored --exclude "legacy_code"
This command will:
repogather performs the following steps:
--all option is used, returns all filtered filesrepogather requires an active OpenAI API key when using LLM analysis. It will prompt you to confirm the expected cost of the query (in input tokens) before proceeding. When using the --all option, no API key is required.
repogather handles repositories of any size by splitting the content into multiple requests when necessary. This allows for analysis of large codebases without hitting API token limits.
FAQs
Easily copy all relevant source files in a repository to clipboard
We found that repogather demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.