
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
penguiflow
Advanced tools
Async-first orchestration library for typed, reliable, concurrent workflows — from deterministic data pipelines to LLM agents.
StreamChunk) and a final answer with deterministic correlation.run(), emit() into, and fetch() results from.NodePolicy (validation, retries, timeout).Message(payload=..., headers=Headers(tenant=...), trace_id=...) enabling trace correlation, cancellation, deadlines, and streaming.Requirements: Python 3.11+
pip install penguiflow
Common extras:
pip install "penguiflow[planner]" # ReactPlanner + ToolNode integrations
pip install "penguiflow[a2a-server]" # A2A HTTP+JSON server bindings
pip install "penguiflow[a2a-client]" # A2A client bindings
If you use uv:
uv pip install penguiflow
from __future__ import annotations
import asyncio
from pydantic import BaseModel
from penguiflow import ModelRegistry, Node, NodePolicy, create
class In(BaseModel):
text: str
class Out(BaseModel):
upper: str
async def to_upper(msg: In, _ctx) -> Out:
return Out(upper=msg.text.upper())
async def main() -> None:
node = Node(to_upper, name="to_upper", policy=NodePolicy(validate="both"))
registry = ModelRegistry()
registry.register("to_upper", In, Out)
flow = create(node.to())
flow.run(registry=registry)
await flow.emit(In(text="hello"))
result: Out = await flow.fetch()
await flow.stop()
print(result.upper)
if __name__ == "__main__":
asyncio.run(main())
uv run penguiflow new my-agent --template react
cd my-agent
uv sync
uv run penguiflow dev --project-root .
Suggested starting points (in-repo sources):
PenguiFlow follows a 2.x line and aims to follow SemVer with a clear public surface.
MIT — see LICENSE.
FAQs
Async-first orchestration library for multi-agent and data pipelines
We found that penguiflow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.