
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
copy-github-directory
Advanced tools
 [](https://codecov.io/gh/rocket-hangar/copy-github-directory)
copy-github-directoryGet a Github directory quickly by a simple command.
Copy the URL on your web browser.
Run copy-github-directory command with the URL. (It is similar git clone)
That's it!
You don't need to install it.
npx copy-github-directory <url> [directory]
Just use it with npx command.
But, if you install (npm install -g copy-github-directory), you can get the short command ghcopy instead
of copy-github-directory.
npx copy-github-directory https://github.com/rocket-hangar/workspace-template
# It will be made `workspace-template` directory on your current location
npx copy-github-directory https://github.com/rocket-hangar/workspace-template project
# It will be made `project` directory on your current location
npx copy-github-directory https://github.com/rocket-hangar/workspace-template .
# It will be made files on your current location
If you use it in a yarn workspaces. (If there are exists yarn.lock and workspaces property on package.json)
It adds workspaces information to package.json files.
For example,
cd my-monorepo
npx copy-github-directory https://github.com/rocket-hangar/templates/tree/main/web project
It will write package.json files like below.
// $PWD/package.json
{
"workspaces": ["project"]
}
// $PWD/project/package.json
{
"name": "project"
}
If you don't want to modify package.json files use the option --no-workspace <url>.
If you have URLs that you use frequently, you can give them aliases.
Make .ghcopy.json file on your home directory like below. ($HOME/.ghcopy.json)
{
"alias": {
"workspace": "https://github.com/rocket-hangar/workspace-template",
"web": "https://github.com/rocket-hangar/templates/tree/main/web",
"packages": "https://github.com/rocket-hangar/templates/tree/main/packages"
}
}
Then you can use command with the alias.
copy-github-directory web my-web-project
workspace: https://github.com/rocket-hangar/workspace-template yarn berry based workspace templateweb: https://github.com/rocket-hangar/templates/tree/main/web vite.js based web app templatepackages: https://github.com/rocket-hangar/templates/tree/main/packages rocket-punch based multi-package templateFAQs
 [](https://codecov.io/gh/rocket-hangar/copy-github-directory)
We found that copy-github-directory demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.