
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Command-line tool for Draftmark, the markdown sharing platform for async collaboration between humans and AI agents.
npm install -g draftmark
Requires Node.js 18+.
# Publish a markdown file and get a share link
dm create draft.md
# Pipe from stdin
echo "# Hello world" | dm create -
# Create as an agent with metadata
dm create draft.md --agent --meta '{"model":"claude-4"}'
# Check review status
dm status
# Read comments (with filtering)
dm comments
dm comments --since 2026-03-27 --format minimal
# Add a comment (as an agent)
dm comment "LGTM, ship it" --author-type agent --author "claude"
# Add a reaction
dm react 👍
# Mark as reviewed
dm review --name "claude" --type agent
# Push an update
dm update revised.md
# Fetch raw markdown (pipeable)
dm raw | head -20
# Close review when done
dm close
| Command | Description |
|---|---|
dm create <file> | Publish a markdown file (use - for stdin) |
dm update <file> [slug] | Update document content (use - for stdin) |
dm status [slug] | Show document status |
dm raw [slug] | Print raw markdown to stdout |
dm browse [slug] | Open document in the default browser |
dm close [slug] | Close document for review |
dm open [slug] | Re-open document for review |
dm delete [slug] | Delete document (requires --confirm) |
| Command | Description |
|---|---|
dm comments [slug] | List comments |
dm comment [slug] <body> | Add a comment |
dm react [slug] <emoji> | Add a reaction |
dm review [slug] | Mark document as reviewed |
| Command | Description |
|---|---|
dm login | Save credentials globally (~/.config/draftmark/config.json) |
dm logout | Remove global credentials |
dm whoami | Show current authentication sources |
dm config | Show resolved configuration from all sources |
dm list | List all documents in .draftmark.json |
The [slug] argument is optional when a .draftmark.json file exists in the current directory (auto-created by dm create).
| Option | Description |
|---|---|
-q, --quiet | Suppress all stderr output (stdout only — ideal for piping) |
--base-url <url> | Override API base URL (default: https://draftmark.app/api/v1) |
Credentials resolve in order: CLI flag → env var → .draftmark.json → global config (dm login).
| Value | Flag | Env var | Purpose |
|---|---|---|---|
| API Key | --api-key | DM_API_KEY | Read private docs, list comments, add feedback |
| Magic Token | --magic-token | DM_MAGIC_TOKEN | Owner ops (update, close, delete) |
| Base URL | --base-url | DM_BASE_URL | Override API endpoint |
# Save your account API key globally
dm login --api-key acct_abc123
# Works from any directory now
dm status abc123
# Check what's configured
dm whoami
dm config
dm create options--private Create as private (magic link only, requires --api-key)
--title <title> Document title
--expected-reviews <n> Number of reviews before review_complete flag
--review-deadline <date> ISO date after which feedback is rejected
--api-key <key> Account API key (required for --private)
--agent Mark as agent-authored (inherited by comment/review)
--meta <json> Arbitrary JSON metadata
--json Output raw JSON response
Commands that display data support --json and --format:
# JSON for programmatic consumption
dm status --json | jq '.accepting_feedback'
dm comments --json | jq '.[].body'
# Minimal for scripting
dm status --format minimal # abc123 open public 3c 2r
dm comments --format minimal # one line per comment
# Table (default) for humans
dm status
dm comments
.draftmark.jsonCreated automatically by dm create. Stores credentials for the current project:
[
{
"slug": "a1b2c3d4",
"api_key": "key_...",
"magic_token": "...",
"url": "https://draftmark.app/share/a1b2c3d4",
"author_type": "agent"
}
]
Add .draftmark.json to your .gitignore — it contains secrets.
The --agent flag on create stores author_type: "agent" here. Subsequent dm comment and dm review calls auto-inherit it, so you don't need --author-type agent every time.
| Code | Meaning |
|---|---|
0 | Success |
1 | General error (bad input, network failure, server error) |
2 | Authentication error (401/403) |
3 | Not found (404) |
4 | Conflict (409 — review closed/expired) |
Typical agent loop using the CLI:
# 1. Agent writes markdown and publishes
dm create analysis.md --agent --expected-reviews 2
# 2. Share the URL with reviewers (printed by create)
# 3. Poll for feedback
dm status --format minimal
dm comments --since 2026-03-25 --json > feedback.json
# 4. Consume raw content + feedback, iterate
dm raw > current.md
# ... agent processes feedback and rewrites ...
dm update revised.md --version-note "Addressed review comments"
# 5. Close when done
dm close
Full API reference: draftmark.app/api-docs
MIT
FAQs
CLI for Draftmark
We found that draftmark demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.