
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
wiki-plugin-commasutra
Advanced tools
Timeboxed collaborative editing plugin for federated wiki - allows users to collaboratively edit content for a limited time
A federated wiki plugin that enables timeboxed collaborative contribution. Multiple users can contribute content within a limited time window, with each contributor getting their own linked page on the main hub.
npm install wiki-plugin-mostly-harmless
IMPORTANT: After installation, restart your wiki server for the plugin to load.
If you encounter issues, see TROUBLESHOOTING.md.
Add a mostly-harmless item to your wiki page:
{
"type": "mostly-harmless",
"id": "abc123"
}
When the page loads, a new collaborative editing session will be created automatically with a 5-minute timer.
To join an existing session, add a mostly-harmless item with a sessionId:
{
"type": "mostly-harmless",
"id": "abc123",
"sessionId": "your-session-id-here"
}
Important: Only the page owner needs to be logged in. Contributors access the session via the shared URL without any login.
The Hub Page: This is where all the magic happens! The hub page contains:
Unlike traditional collaborative editing where everyone edits the same document, Mostly Harmless gives each contributor their own content space:
client/mostly-harmless.js)server/server.js)POST /plugin/mostly-harmless/create-session
{ sessionId, createdAt, expiresAt, contributions }GET /plugin/mostly-harmless/session/:sessionId
POST /plugin/mostly-harmless/submit
{ sessionId, handle, content }{ success, contribution, pageUrl, contributionCount }mostly-harmless-{sessionId}-{handle-slug}GET /plugin/mostly-harmless/session/:sessionId/history (optional)
Default: 5 minutes (300 seconds)
To change the duration, modify SESSION_DURATION in client/mostly-harmless.js:
const SESSION_DURATION = 300; // 5 minutes in seconds
And SESSION_DURATION_MS in server/server.js:
const SESSION_DURATION_MS = 5 * 60 * 1000; // 5 minutes
✅ Implemented! When a user submits their contribution, the plugin automatically creates a real wiki page for them.
Each contributor's page includes:
{
"title": "Alice's Contribution",
"story": [
{
"type": "paragraph",
"text": "The actual content submitted by the user..."
},
{
"type": "paragraph",
"text": "—Alice"
},
{
"type": "paragraph",
"text": "Submitted 1/19/2026, 3:45:00 PM"
}
]
}
mostly-harmless-{sessionId}-{handle-slug}The plugin is designed to integrate with Sessionless authentication:
// Generate signature for session access
const sessionUrl = await sessionless.generateAuthenticatedUrl(sessionId);
This would enable:
Instead of in-memory sessions, use BDO (Big Dumb Object) storage:
// Save session to BDO
await bdo.updateBDO(uuid, `mostly-harmless-${sessionId}`, sessionData, true);
// Retrieve session from BDO
const sessionData = await bdo.getBDO(uuid, `mostly-harmless-${sessionId}`);
Benefits:
Add WebSocket support for live updates:
// Notify all connected clients when new contribution added
io.to(sessionId).emit('new-contribution', contribution);
Users would see new contributors appear in real-time without refreshing the page.
No build step required - pure JavaScript.
Install in your federated wiki instance:
npm install /path/to/wiki-plugin-mostly-harmless
Restart your wiki server
Add a mostly-harmless item to a page
Open the page and start collaborating!
MIT
Planet Nine (planetnineisaspaceship)
January 19, 2026 - Initial release
FAQs
Timeboxed collaborative editing plugin for federated wiki - allows users to collaboratively edit content for a limited time
We found that wiki-plugin-commasutra demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.