
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
@routerlab/core
Advanced tools
@routerlab/coreThe routing engine for routerlab — cost-quality routing for LLM APIs with open Pareto frontiers per task class.
@routerlab/core picks the cheapest LLM model that meets a quality bar
(and any caller-supplied budget / latency caps) for a given task. Cost is
grounded in atlas-calibrated empirical token economics rather than
chars/4 proxies, and quality is predicted from a published per-task prior
(or measured eval data when available).
This is the library; the @routerlab/cli
package wraps it as the route command.
bun add @routerlab/core
# or
npm install @routerlab/core
import { BudgetAwareRouter, route, predictQuality, estimateCost } from "@routerlab/core";
const decision = await route({
task: "qa",
prompt: "What's the capital of France?",
qualityBar: 0.85,
maxCostUsd: 0.005, // optional hard budget cap
maxLatencyMs: 2000, // optional hard latency cap
});
console.log(decision.chosen?.model.model);
// e.g. "claude-sonnet-4-6"
for (const fb of decision.fallbacks) console.log("fallback:", fb.model.model);
for (const sk of decision.skipped) console.log("skipped:", sk.model.model, sk.reason);
const budget = new BudgetAwareRouter({
maxBudgetUsd: 0.25,
warnAt: 0.8,
degradedQualityBar: 0.65,
});
while (!done) {
const step = budget.routeStep({
task: "reasoning",
prompt: agentContext,
qualityBar: 0.85,
});
const response = await callYourModel(step.decision.chosen.model, agentContext);
budget.recordActualUsage({
model: step.decision.chosen.model,
usage: {
inputTokens: response.usage.prompt_tokens,
outputTokens: response.usage.completion_tokens,
},
});
}
routeStep() caps the next decision by the remaining chain budget. After the
provider call, recordActualUsage() prices the real usage with Tokenometer's
runtime usage-pricing primitive. If a provider does not return usage, call
recordEstimatedStep(step.decision) to account for the selected estimate.
RouteDecision shapetype RouteDecision = {
chosen: RoutePick | null; // null when no candidate passes the filters
fallbacks: RouteFallback[]; // ordered cheapest-next
skipped: RouteSkipped[]; // every dropped candidate, with a reason
request: RouteRequest; // echoed
};
See types.ts for the full shape. RoutePick carries
expectedCost, expectedQuality, reasoning, and the underlying
ModelCandidate.
route(req) — top-level routing entry point.BudgetAwareRouter — stateful task budget controller for multi-step
agent loops. It preflights each step with routerlab and records actual or
estimated spend after each call.predictQuality / predictQualityWithCI — quality predictor; serves
measured eval data when present, falls back to the seeded prior table
(Wilson 95% CI exposed via the WithCI variant).estimateCost / estimateCostBatch — atlas-calibrated cost
estimation. This is the load-bearing differentiation versus prior open
routers: token counts come from offline counters scaled by per-provider
empirical correction factors from
llm-tokens-atlas, not a
chars/4 proxy.getDefaultCandidates() — current candidate pool.ModelCandidate, RouteRequest, RouteDecision,
TaskClass, Provider, etc.| Variable | Effect |
|---|---|
ROUTERLAB_ATLAS_RESULTS_PATH | Atlas calibration file path (read by cost.ts) |
ROUTERLAB_QUALITY_TABLE_PATH | Measured quality table path (read by quality_predictor.ts) |
When unset, the engine falls back to seeded defaults shipped in the package.
routerlab@routerlab/clillm-tokens-atlasApache-2.0. See LICENSE.
FAQs
Routing engine for cost-quality LLM model selection.
We found that @routerlab/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.