Evaluate `tiged` Typosquat Warning and Consider Alternatives

[Josephat-S]

What to build

Socket flagged tiged as a possible typosquat of giget (a more popular package). While tiged is a legitimate fork of degit, this warning combined with the CVE and deprecated deps suggests we should evaluate replacing it.

Alternatives to evaluate

• giget — Modern, maintained, used by Nuxt/UnJS ecosystem. Supports GitHub, GitLab, Bitbucket.
• degit — Original by Rich Harris, but unmaintained.
• Custom solution — Use fetch to download GitHub tarball + tar to extract. Zero dependencies.

Specs

• Must support: cloning a subdirectory from a GitHub repo (e.g., Ebyte-Lab/opusify-templates/portfolio/nextjs-monolith).
• Must support: private repos with token auth.
• Should not add deprecated or vulnerable transitive dependencies.

Acceptance criteria

• Evaluate giget as a replacement (test with our repo structure).
• If giget works: replace tiged with giget, update src/generate.js.
• If custom solution: implement GitHub tarball download with node:https + tar.
• Socket scan shows no typosquat warnings after the change.
• All template generation tests still pass.

[meekness12]

I am claiming this task.

[Josephat-S]

Hello Dear @meekness12 if you finish working on it please link/tag the issue you was working on