
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@hapticdata/lgtm
Advanced tools
A terminal UI for reviewing documents with line-by-line commenting. Perfect for reviewing AI-generated plans, code proposals, or any text document that needs structured feedback.
Run lgtm directly without installing:
bunx @hapticdata/lgtm document.md
Install lgtm as a Claude Code plugin from the marketplace:
# In Claude Code, run these commands:
/plugin marketplace add hapticdata/lgtm
/plugin install lgtm@lgtm
Or locally after cloning the repository:
claude plugin install lgtm --plugin-dir .
Once installed, you can use these skills:
/lgtm <file> - Review a file with line-by-line commenting/lgtm-context - Review Claude's last response/lgtm-plan - Review the current plan fileThe plugin automatically spawns a tmux pane for side-by-side review. When you quit (press q), your feedback is sent back to Claude for discussion.
For standalone command-line usage without Claude Code:
bun install
bun link
Then use the lgtm command directly:
lgtm document.md
Why Bun? lgtm uses Bun-specific APIs (Bun.file(), Bun.write(), Bun.stdin) for better performance and simpler code. These APIs are not available in Node.js or other runtimes.
Review a file in your terminal:
lgtm document.md
# Review in current terminal (default)
lgtm <file>
# Explicitly show in current terminal
lgtm show <file>
# Open in tmux split pane
lgtm spawn <file>
# Export comments to stdout
lgtm export <file>
# Show terminal environment info
lgtm env
| Option | Description |
|---|---|
--session <name> | Named session for separate comment storage |
--comments <file> | Load comments from a specific file |
--readonly | View-only mode (no editing) |
--export-on-quit <path> | Export comments to file when quitting |
--stdin | Read content from stdin instead of file |
--context | Load Claude's last response from current session |
--tmux | Open in tmux split pane |
# Export as markdown (default)
lgtm export document.md
# Export as JSON
lgtm export document.md --format json
# Export specific session
lgtm export document.md --session my-review
| Key | Action |
|---|---|
j / Down | Scroll down / Next comment |
k / Up | Scroll up / Previous comment |
g | Go to top |
G | Go to bottom |
Tab | Switch between document and comments panel |
Enter | Jump to commented line (in comments panel) |
| Key | Action |
|---|---|
c | Add comment on current line |
e | Edit selected comment |
d | Delete selected comment |
r | Toggle resolved status |
1-6 | Select comment type when adding |
| Key | Type | Purpose |
|---|---|---|
1 | Blocker | Critical issues that must be addressed |
2 | Concern | Potential issues to evaluate |
3 | Question | Need clarification |
4 | Suggestion | Improvements to consider |
5 | Praise | Highlight good work |
6 | Acknowledge | Noted/acknowledged |
| Key | Action |
|---|---|
f | Cycle through comment filters |
v | Toggle summary view |
y | Copy feedback to clipboard |
s | Save session |
? | Toggle help |
q / Esc | Quit |
| Variable | Purpose |
|---|---|
LGTM_TMUX=1 | Default to tmux mode (skip --tmux flag) |
TMUX_PANE | Target pane for tmux splits |
Comments are stored in JSON files alongside the reviewed document:
document.md # Original file
.lgtm-document.json # Comments file
With sessions:
.lgtm-document-mysession.json
lgtm integrates with Claude Code for AI-assisted review workflows. When used with --export-on-quit, comments are automatically exported when you quit.
# Claude Code can spawn lgtm and wait for your review
lgtm document.md --export-on-quit /tmp/feedback.md
The --context flag loads Claude's last response for review:
lgtm --context
MIT
FAQs
TUI for reviewing documents with line-by-line commenting
We found that @hapticdata/lgtm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.