
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@opentweet/cli
Advanced tools
Official CLI for OpenTweet.io - manage your X/Twitter content from the terminal
Control your OpenTweet.io account from the terminal. Schedule posts to X, Bluesky and LinkedIn, check analytics, manage your evergreen queue and more without touching the browser.
npm install -g @opentweet/cli
Requires Node 18 or later.
Grab your API key from the OpenTweet dashboard under Settings > API Keys, then run:
opentweet auth
It will prompt you for the key, validate it, and save it. You are good to go.
opentweet me # your plan, limits, connected accounts
opentweet accounts # list all connected X accounts
opentweet platforms # cross-posting status: connected networks and defaults
# write a tweet (opens a prompt if you leave the text out)
opentweet tweet
opentweet tweet "just shipped something cool"
# publish it straight away
opentweet tweet "hot take" --now
# save as a scheduled post
opentweet tweet "monday motivation" --schedule "2026-05-12 09:00"
# post from a specific account (multi-account plans)
opentweet tweet "thread drop soon" --account <account-id>
# publish the same text to X and Bluesky
opentweet tweet "shipped it" --now --bluesky
# same thing, spelled out
opentweet tweet "shipped it" --now --platforms x,bluesky
# Bluesky only
opentweet tweet "hello atproto" --now --platforms bluesky
# X and LinkedIn
opentweet tweet "shipped it" --now --linkedin
# all three networks
opentweet tweet "shipped it" --now --platforms x,bluesky,linkedin
# LinkedIn only
opentweet tweet "we are hiring" --now --platforms linkedin
--platforms takes a comma separated list of x, bluesky and linkedin. --bluesky is shorthand for --platforms x,bluesky, --linkedin for --platforms x,linkedin, and passing both gives all three. An explicit list is always honoured exactly.
LinkedIn posts go to your personal profile (Company Pages are not supported). Connect it in the dashboard under Settings > Accounts > Connect LinkedIn. The sign-in lasts 60 days, then needs a one-click reconnect. A LinkedIn post can be up to 3,000 characters (an emoji counts as 2). A thread goes to LinkedIn as one post with the parts joined by a blank line. Video is not supported, so LinkedIn is skipped with a reason. Hashtags and mentions publish as plain text, and there are no LinkedIn analytics.
Leaving --platforms out is not the same as pinning the post to X. An unspecified post follows your account's auto cross-post setting: when that is on, it goes to every network you have connected. Run opentweet platforms to see where an unspecified post would actually land, whether auto cross-post is on, and which networks can publish right now:
opentweet platforms
A network can be connected without being able to publish. If an authorisation expires, opentweet platforms shows it as connected, needs reconnecting rather than ready to publish, and splits Unspecified posts attempted on from Of those, actually land on so you can see the gap before a post fails. Undeliverable networks are still attempted on purpose, so the failure is recorded rather than silently dropped.
After publishing, the CLI prints a line per network so a partial success is visible straight away:
Per network
✓ X https://x.com/you/status/1234567890
○ Bluesky skipped (no Bluesky account connected)
A skip is not a failure. The post went out, one target was dropped, and the reason says why.
opentweet list # all posts
opentweet list --status scheduled # just scheduled ones
opentweet list --status draft
opentweet list --limit 50 --page 2
opentweet publish <id> # publish a draft now
opentweet schedule <id> --time "2026-05-13 10:00"
opentweet delete <id> # delete a draft or scheduled post
opentweet delete <id> --x # also remove it from X
IDs in the list output are shortened. Pass the short 8-character suffix or the full ID.
opentweet analytics # posting overview, streaks, best times
opentweet analytics --tweets # per-tweet engagement breakdown
opentweet analytics --top # your top performing posts
opentweet analytics --account <id> # filter by account
The evergreen queue automatically reposts your best content on a rotation.
opentweet evergreen list # see what is in the queue
opentweet evergreen add <post-id> # add a post to the queue
opentweet evergreen remove <id> # remove a post from the queue
opentweet evergreen settings # view queue config
opentweet evergreen toggle # turn the queue on or off
opentweet search "indie hacking"
opentweet search "solopreneur" --limit 20
The API key is stored in ~/.config/opentweet/config.json. You can also set it via environment variable if you prefer not to store it on disk:
export OPENTWEET_API_KEY=ot_your_key_here
To point the CLI at a different API base (useful for local dev):
export OPENTWEET_API_URL=http://localhost:3000
To see your saved key or clear it:
opentweet auth --show
opentweet auth --clear
If you are on the Advanced or Agency plan you can connect multiple X accounts. Use opentweet accounts to list them and pass --account <id> to any command that creates or fetches posts.
--account and --platforms are separate choices: --account picks which X account posts, --platforms picks which networks the post goes to.
Some commands require a paid subscription. The CLI will tell you when you hit a limit. Run opentweet me to see your current plan and how many posts you have left today.
Report bugs and feature requests at github.com/opentweet/cli.
FAQs
Official CLI for OpenTweet.io - manage your X/Twitter content from the terminal
The npm package @opentweet/cli receives a total of 0 weekly downloads. As such, @opentweet/cli popularity was classified as not popular.
We found that @opentweet/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.