
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the projectβs GitHub releases.
π Instantly generate nested folder & file structures from flat or ASCII tree text files. Ideal for scaffolding projects in seconds.
Generate folder and file structures from plain text lists or ASCII trees in seconds.
mkstruct@2.0 ships a faster tree normalizer, smarter file detection, and a slimmer CLI tailored for everyday scaffolding workflows.
Makefile, Dockerfile, and dotfiles.npx, inline structures via -s, piping with --stdin, and verbose tracing when you need insight.Requires Node.js 14.0.0 or newer.
| Use case | Command |
|---|---|
| Try once with npx | npx mkstruct structure.txt |
| Install globally | npm install -g mkstruct |
| Add to a project | npm install --save-dev mkstruct |
Each option exposes the same mkstruct binary.
Create structure.txt:
src/index.js
src/utils/api.js
src/components/Button.jsx
public/index.html
README.md
Generate:
npx mkstruct structure.txt
Create tree.txt:
βββ src
β βββ index.js
β βββ utils
β β βββ api.js
β βββ components
β βββ Button.jsx
βββ public
β βββ index.html
βββ README.md
Generate:
npx mkstruct tree.txt
mkstruct automatically detects the format and creates folders before files so hierarchies stay intact.
mkstruct [file] [options]
| Flag | Description |
|---|---|
-d, --dry-run | Preview actions without touching the file system |
-f, --force | Overwrite files that already exist |
-s, --structure <text> | Supply the structure inline (great for snippets) |
--stdin | Read structure from standard input (pipe support) |
-v, --verbose | Show parsing and normalization diagnostics |
-h, --help | Display usage information |
Preview output:
mkstruct structure.txt --dry-run
Pipe a remote definition:
curl -s https://example.com/structure.txt | mkstruct --stdin
Inline structure on the fly:
mkstruct -s "api/\nβββ routes/\nβ βββ users.js\nβββ server.js"
Regenerate boilerplate forcefully:
mkstruct structure.txt --force
Inspect normalization behaviour:
mkstruct tree.txt --verbose
/) to separate folders.βββ, βββ, and β (single- or double-dash variants both work).project as the first line, for example).Example:
project
βββ src
β βββ index.js
β βββ utils
β βββ helper.js
βββ README.md
src/App.jsx
src/main.jsx
src/components/Navbar.jsx
src/components/Hero.jsx
src/components/Footer.jsx
src/pages/Home.jsx
src/pages/About.jsx
src/hooks/useAuth.js
src/utils/api.js
src/styles/globals.css
public/favicon.ico
npx mkstruct react-structure.txt
βββ server.js
βββ config
β βββ database.js
β βββ environment.js
βββ routes
β βββ api.js
β βββ auth.js
β βββ users.js
βββ controllers
β βββ authController.js
β βββ userController.js
βββ models
β βββ User.js
βββ middleware
β βββ auth.js
β βββ errorHandler.js
βββ utils
βββ logger.js
βββ validators.js
npx mkstruct backend-tree.txt
docs/getting-started.md
docs/api/authentication.md
docs/api/endpoints.md
docs/guides/deployment.md
docs/guides/testing.md
docs/examples/basic.md
docs/examples/advanced.md
--force is supplied.| Symptom | Cause | Fix |
|---|---|---|
Error: No input provided | No file, --stdin, or -s argument supplied | Provide a filename, pipe stdin, or use -s |
| Files appear in the wrong place | Ran the command from the wrong directory | pwd, cd into the project root, rerun |
| Tree format not detected | Non-standard characters or broken indentation | Copy the tree glyphs exactly; run with --verbose for hints |
Refusing to write outside CWD | Paths contain .. or absolute segments | Ensure all paths stay relative to the project root |
npm install.npm test.git clone https://github.com/Gitnaseem745/mkstruct.git
cd mkstruct
npm install
npm test
Bug reports and feature ideas are welcome via GitHub Issues.
MIT Β© Naseem Ansari
See the full text in LICENSE.
If mkstruct saves you setup time, consider dropping the repo a βοΈ.
Made with β€οΈ by developers, for developers
FAQs
π Instantly generate nested folder & file structures from flat or ASCII tree text files. Ideal for scaffolding projects in seconds.
We found that mkstruct demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the projectβs GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.