
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
promptlayer
Advanced tools
The first platform built for prompt engineers
PromptLayer is the first platform that allows you to track, manage, and share your GPT prompt engineering. PromptLayer acts a middleware between your code and OpenAI’s JavaScript library.
PromptLayer records all your OpenAI API requests, allowing you to search and explore request history in the PromptLayer dashboard.
This repo contains the JavaScript wrapper library for PromptLayer.
npm install promptlayer
Use npm install . to install locally.
To get started, create an account by clicking “Log in” on PromptLayer. Once logged in, click the button to create an API key and save this in a secure location (Guide to Using Env Vars).
export OPENAI_API_KEY=sk_xxxxxx
export PROMPTLAYER_API_KEY=pl_xxxxxx
Once you have that all set up, install PromptLayer using npm.
In the JavaScript file where you use OpenAI APIs, add the following. This allows us to keep track of your requests without needing any other code changes.
import BaseOpenAI from "openai";
import { PromptLayer } from "promptlayer";
const promptlayer = new PromptLayer({
apiKey: process.env.PROMPTLAYER_API_KEY,
});
// Typescript
const OpenAI: typeof BaseOpenAI = promptlayer.OpenAI;
const openai = new OpenAI();
You can then use openai as you would if you had imported it directly.
pl_tagsPromptLayer allows you to add tags through the pl_tags argument. This allows you to track and group requests in the dashboard.
Tags are not required but we recommend them!
openai.chat.completions.create({
messages: [{ role: "user", content: "Say this is a test" }],
model: "gpt-3.5-turbo",
// @ts-ignore
pl_tags: ["test"],
});
return_pl_idPromptLayer allows you to return the request id through the return_pl_id argument. When you set this to true, a tuple is returned with the request id as the second element.
openai.chat.completions.create({
messages: [{ role: "user", content: "Say this is a test" }],
model: "gpt-3.5-turbo",
// @ts-ignore
return_pl_id: true,
});
Notice the `ts-ignore` comment. This is because the `pl_tags` and `return_pl_id` arguments are not part of the OpenAI API. We are working on a way to make this more seamless.
After making your first few requests, you should be able to see them in the PromptLayer dashboard!
OpenAI Agents telemetry support is available as an optional extension of the base library.
npm install promptlayer @openai/agents
Claude Agents plugin support is available as an optional extension of the base library on macOS and Linux.
npm install promptlayer @anthropic-ai/claude-agent-sdk
import { ClaudeAgentOptions } from "@anthropic-ai/claude-agent-sdk";
import { getClaudeConfig } from "promptlayer/claude-agents";
const plClaudeConfig = getClaudeConfig();
const options = new ClaudeAgentOptions({
model: "claude-sonnet-4-5",
plugins: [plClaudeConfig.plugin],
env: {
...plClaudeConfig.env,
},
});
We welcome contributions to our open source project, including new features, infrastructure improvements, and better documentation. For more information or any questions, contact us at hello@promptlayer.com.
FAQs
Unknown package
We found that promptlayer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.