
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Lightweight table/text/markdown reviewer with in-browser comments, sticky rows/columns, filters, auto-exit YAML payloads.
A lightweight browser-based tool for reviewing and annotating tabular data, text, and Markdown files. Supports CSV, TSV, plain text, and Markdown. Comments are output as YAML to stdout.
npm install -g annotab
Or run directly with npx:
npx annotab <file>
# Single file
annotab <file> [--port 3000] [--encoding utf8|shift_jis|...]
# Multiple files (each opens on consecutive ports)
annotab file1.csv file2.md file3.tsv --port 3000
open / Linux: xdg-open / Windows: start)--encoding to specify or let chardet auto-detect (Shift_JIS, CP932, etc.)--no-open to prevent automatic browser opening

file: data.csv
mode: csv
reason: button
at: '2025-11-26T12:00:00.000Z'
comments:
- row: 2
col: 3
text: This value needs review
value: '150'
cli.cjsnpm test (vitest + playwright)MIT
FAQs
Lightweight table/text/markdown reviewer with in-browser comments, sticky rows/columns, filters, auto-exit YAML payloads.
We found that annotab demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.