
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Prompt minimizer for LLM evals: shrink a prompt to the smallest input that still reproduces a failure (delta debugging / ddmin).
Prompt minimizer for LLM evals: shrink a prompt to the smallest input that still reproduces a failure (delta debugging / ddmin).
Download promptmin-*.tgz from the Release, then:
npm install -g ./promptmin-*.tgz
promptmin --help
strict / k-of-n) and --confirm-final.npm install
npm run build
node packages/promptmin-cli/dist/cli.js minimize \
--prompt examples/prompts/support.md \
--config examples/configs/promptmin.config.json \
--out .promptmin/out \
--target test:refund_policy_01 \
--budget-runs 60
Artifacts land in .promptmin/out/.
Artifacts:
baseline.prompt, minimized.promptdiff.patchreport.md, meta.jsontrace.jsonl (unless --no-trace-output)Exit codes:
0: minimized prompt still fails (success)2: baseline prompt did not fail3: best-effort result (budget exceeded and/or --confirm-final did not reproduce)4: runner/config errorlocal_commandexamples/configs/promptmin.config.json:
{
"runner": { "type": "local_command", "command": ["bash", "-lc", "python3 examples/runners/run_eval.py"] },
"tests": [{ "id": "refund_policy_01", "input": { "user": "..." }, "assert": { "type": "regex_not_match", "pattern": "..." } }]
}
Runner contract: promptmin runs your command once per test/trial and provides:
PROMPT_FILE: path to a prompt snapshot file (baseline: baseline.prompt, candidates: out/candidates/<sha>.prompt)PROMPT_TEXT: full prompt textTEST_JSON: full test object JSON (includes id, input, assert)TEST_ID: test idPROMPTMIN_TRIAL_INDEX, PROMPTMIN_TRIAL_COUNT: stability retry metadataopenai_responses{
"runner": { "type": "openai_responses", "model": "gpt-4.1-mini", "max_retries": 2 },
"tests": [{ "id": "refund_policy_01", "input": { "user": "..." }, "assert": { "type": "regex_not_match", "pattern": "..." } }]
}
Prompt format: optional YAML-ish role blocks (system:, developer:, user:). promptmin appends tests[].input.user (or JSON) as the final user message.
Requires OPENAI_API_KEY (or set runner.api_key_env).
Example prompt:
system: |
You are a helpful support agent.
developer: |
Follow the company refund policy.
--strategy ddmin (default) or --strategy greedy--granularity sections|blocks|sentences|lines--stability-mode strict --stability-n 3 or --stability-mode kofn --stability-n 5 --stability-k 3--confirm-final--no-trace-output (disables trace.jsonl + candidate snapshots)--target test:<id> (or suite:any / suite:all)Keep tag inside any chunk to prevent deletion:
<!-- promptmin:keep --># keepOr configure preserve selectors:
{ "prompt": { "preserve": [{ "type": "heading", "value": "Safety policy" }, { "type": "regex", "pattern": "DO NOT REMOVE" }] } }
FAQs
Prompt minimizer for LLM evals: shrink a prompt to the smallest input that still reproduces a failure (delta debugging / ddmin).
We found that promptmin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.