
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
hackwriter
Advanced tools
Writing Agent for HackMD - Zero-config, multi-provider LLM support
npx hackwriter
If you don't have API keys configured, the setup wizard will guide you through it.
That's it! No config files needed.
npm i -g hackwriter
hackwriter
/modelRun hackwriter and follow the setup wizard. It will ask for:
Environment Variables - Skip setup wizard by setting these:
export ANTHROPIC_API_KEY=sk-ant-xxx # or OPENAI_API_KEY
export HACKMD_API_TOKEN=your-token
hackwriter # Starts immediately!
| Variable | Description |
|---|---|
ANTHROPIC_API_KEY | Anthropic API key (optional) |
OPENAI_API_KEY | OpenAI API key (optional) |
HACKMD_API_TOKEN | HackMD API token (required) |
HACKMD_API_URL | HackMD API URL (optional, default: https://api.hackmd.io/v1) |
HackMD CLI Compatibility - Also supports HackMD CLI environment variables:
export HMD_API_ACCESS_TOKEN=your-token # Same as HACKMD_API_TOKEN
export HMD_API_ENDPOINT_URL=https://... # Same as HACKMD_API_URL
Note: If you're already using HackMD CLI, HackWriter will automatically detect and use your existing
HMD_API_ACCESS_TOKENenvironment variable. No additional configuration needed!
Config File - Override defaults with ~/.hackwriter/config.json:
{
"defaultModel": "anthropic-claude-3-5-sonnet-latest",
"models": {
"fast": {
"provider": "anthropic",
"model": "claude-3-5-haiku-latest",
"maxContextSize": 200000
}
}
}
hackwriter # Start interactive mode
hackwriter --continue # Resume last session
hackwriter --debug # Enable debug logging
hackwriter -m gpt-4o # Use specific model
/help # Show available commands
/model # List/switch models
/model openai-gpt-4o # Switch to GPT-4o
/status # Show current status
/exit # Exit (or /quit, /q)
hackwriter -c "list my notes"
hackwriter -c "create a note titled 'Meeting Notes'"
hackwriter --yolo # Skip all confirmations
export ANTHROPIC_API_KEY=sk-ant-xxx
Models: Claude 3.5 Haiku, Sonnet, Opus 4
export OPENAI_API_KEY=sk-xxx
Models: GPT-4o, GPT-4o-mini, o1
# Ollama auto-detected if running
ollama serve
All local models automatically discovered
FAQs
Writing agent for HackMD
We found that hackwriter demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.