
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
hitt is a command line HTTP testing tool focused on speed and simplicity.

hitt 0.0.21
Command line HTTP testing tool focused on speed and simplicity
Mads Hougesen <mads@mhouge.dk>
Usage: hitt <COMMAND>
Commands:
run Send http requests
sse Listen to sse events
completions Generate shell completions
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print help
-V, --version Print version
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/hougesen/hitt/releases/latest/download/hitt-installer.sh | sh
powershell -ExecutionPolicy ByPass -c "irm https://github.com/hougesen/hitt/releases/latest/download/hitt-installer.ps1 | iex"
hitt can be installed using Cargo.
cargo install hitt --locked
If you do not have Cargo installed, you need to install it first.
You can install hitt using npm:
npm install -g hitt-cli
hitt run hello-world.http
or run it directly using npx:
npx hitt-cli run hello-world.http
brew install hougesen/tap/hitt
To send a request create a file ending in .http.
The syntax of .http files is pretty straightforward:
GET https://mhouge.dk/
The file can then be run using the following command:
hitt run PATH_TO_FILE
That is all that is need to send a request.
Send http requests
Usage: hitt run [OPTIONS] [PATHS]...
Arguments:
[PATHS]... Path to .http files, or directories if supplied with the `--recursive` argument
Options:
--timeout <TIMEOUT_MS> Request timeout in milliseconds
--var <KEY>=<VALUE> Variables to pass to request
-r, --recursive Enable to run directory recursively
--fail-fast Exit on error response status code
--hide-body Whether or not to show response body
--hide-headers Whether or not to show response headers
--disable-formatting Disable pretty printing of response body
-h, --help Print help
-V, --version Print version
| Argument | Description |
|---|---|
--var <KEY>=<VALUE> | Variables to pass to request |
--recursive | Run all files in directory |
--fail-fast | Exit on status code 4XX or 5xx |
--hide-headers | Hide response headers |
--hide-body | Hide response body |
--timeout <TIMEOUT_MS> | Request timeout in ms |
Request headers can be added by writing key value pairs (KEY:VALUE) on a new line after the method and URL:
GET https://mhouge.dk/
key:value
Leading spaces in the header value is ignored, so KEY: VALUE and KEY:VALUE will both have the value VALUE.
A body can be sent with the request by creating a blank line, followed by the desired body input.
Please note, hitt does not infer content type. That has to be written as a header.
POST https://mhouge.dk/
content-type:application/json
{
"key": "value"
}
Multiple requests can be written in a single file by adding a line with ### as a separator:
GET https://mhouge.dk/
###
GET https://mhouge.dk/
hitt has support for request variables.
A variable can be set in a file using the following syntax @name = VALUE. Whitespace is ignored.
Variables are used by wrapping the name in curly brackets ({{ name }}).
@variable_name = localhost
GET {{ variable_name }}/api
In-file variables are not shared between other files.
Variables can be passed to all requests using the --var <KEY>=<VALUE> argument:
# file.http
GET {{ host }}/api
The file can the be run:
hitt run --var host=localhost:5000 file.http
A SSE listener can be started using the hitt sse command.
hitt sse https://sse.dev/test
Listen to sse events
Usage: hitt sse <URL>
Arguments:
<URL>
Options:
-h, --help Print help
-V, --version Print version
Shell completions can be generated using hitt completions <SHELL>.
Generate shell completions
Usage: hitt completions <SHELL>
Arguments:
<SHELL> [possible values: bash, elvish, fish, nushell, powershell, zsh]
Options:
-h, --help Print help
-V, --version Print version
Add the following to your .bashrc.
eval "$(hitt completions bash)"
Add the following to your .zshrc.
eval "$(hitt completions zsh)"
Add the following to ~/.config/fish/config.fish.
hitt completions fish | source
Add the following to your PowerShell configuration (Can be found by running $PROFILE).
Invoke-Expression (&hitt completions powershell)
Add the following to ~/.elvish/rc.elv.
eval (hitt completions elvish)
hitt can be run directly from Neovim.
[!NOTE] The
hittexecutable must be available in your path for the plugin to work.
local hitt_plugin = {
"hougesen/hitt",
opts = {},
}
The plugin exposes a single command :HittSendRequest, which can be bound to a keymap like this:
-- ~/.config/nvim/after/plugin/hitt.lua
local hitt = require("hitt")
vim.keymap.set("n", "<leader>rr", hitt.HittSendRequest, {})

| Name | Default | Description |
|---|---|---|
| window_width | 80 | Window width in percentage |
| window_height | 80 | Window height in percentage |
| fail_fast | false | Enables the --fail-fast options |
Syntax highlighting can be enabled by installing the http treesitter parser (:TSInstall http) and adding a file association for .http files.
vim.filetype.add({
extension = {
http = "http",
},
})
hitt is most likely not ready for main stream usage. I (Mads Hougesen) am primarily developing it based on features I believe to be useful, or fun to develop.
23 August 2025
#528#527#525#526#524#523#522#521#518#519#516#515#514#513#511#512#510#509#508FAQs
Command line HTTP testing tool focused on speed and simplicity
The npm package hitt-cli receives a total of 3 weekly downloads. As such, hitt-cli popularity was classified as not popular.
We found that hitt-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.