
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@hackmd/api
Advanced tools
This is a Node.js client for the HackMD API.
You can sign up for an account at hackmd.io, and then create access tokens for your projects by following the HackMD API documentation.
For bugs and feature requests, please open an issue or pull request on GitHub.
v2.0.0 is a completely rewrite and is incompatible with v1.x.x. But the best of all, it does not require Node.JS runtime anymore, which means you can use it in a browser. We recommend you to upgrade to v2.0.0 if you are using the old one.
npm install @hackmd/api --save
// Default import
import HackMDAPI from '@hackmd/api'
// Or named import
import { API } from '@hackmd/api'
const client = new HackMDAPI('YOUR_ACCESS_TOKEN' /* required */, 'https://api.hackmd.io/v1' /* optional */)
client.getMe().then(me => {
console.log(me.email)
})
// Default import
const HackMDAPI = require('@hackmd/api').default
// Or named import
const { API } = require('@hackmd/api')
const client = new HackMDAPI('YOUR_ACCESS_TOKEN', 'https://api.hackmd.io/v1')
client.getMe().then(me => {
console.log(me.email)
})
For backward compatibility, the package also supports legacy import paths:
// ESM
import HackMDAPI from '@hackmd/api/dist'
import { API } from '@hackmd/api/dist'
// CommonJS
const HackMDAPI = require('@hackmd/api/dist').default
const { API } = require('@hackmd/api/dist')
// Direct file imports
import { API } from '@hackmd/api/dist/index.js'
The client supports automatic retry for failed requests with exponential backoff. You can configure retry behavior when creating the client:
const client = new HackMDAPI('YOUR_ACCESS_TOKEN', 'https://api.hackmd.io/v1', {
retryConfig: {
maxRetries: 3, // Maximum number of retry attempts
baseDelay: 100 // Base delay in milliseconds for exponential backoff
}
})
The client will automatically retry requests that fail with:
By default, the client automatically unwraps the response data from the Axios response object. You can control this behavior using the unwrapData option:
// Get raw Axios response (includes headers, status, etc.)
const response = await client.getMe({ unwrapData: false })
// Get only the data (default behavior)
const data = await client.getMe({ unwrapData: true })
The client supports ETag-based caching for note retrieval. You can pass an ETag to check if the content has changed:
// First request
const note = await client.getNote('note-id')
const etag = note.etag
// Subsequent request with ETag
const updatedNote = await client.getNote('note-id', { etag })
// If the note hasn't changed, the response will have status 304
See the code and typings. The API client is written in TypeScript, so you can get auto-completion and type checking in any TypeScript Language Server powered editor or IDE.
MIT
FAQs
HackMD Node.js API Client
We found that @hackmd/api demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.