npm promptfoo @0.121.13
score
0.7
high
flagged
2026-06-01 23:25
Signals fired
| signal | weight | rationale |
|---|---|---|
| topology | ||
| mass_publish_burst | 0.8 | publisher 'GitHub Actions' pushed 286 packages in the last 15min on npm |
| dependency_added_unknown | 0.6 | 2 new non-watchlisted dep(s): ['@inquirer/search', '@libsql/client'] |
Prior profile (what it deviated from)
{
"had_install_script": false,
"maintainers": [
"sklein12",
"mdangelo",
"ianw",
"justinbeckwith",
"faizanminhas"
],
"versions": 409
}
Evidence (package doc at flag time)
{
"dependencies_count": 78,
"dist": {
"integrity": "sha512-DBPSixUophzcD7S7lML6SqVwnVtrhK5A3HsZ03IG9Xrw0t24r5imG7nLj+YMb0vlAjbdFtE7yFG+rsqDpfYp6g==",
"tarball": "https://registry.npmjs.org/promptfoo/-/promptfoo-0.121.13.tgz",
"unpackedSize": 26521266
},
"dist-tags": {
"latest": "0.121.13"
},
"latest_version": "0.121.13",
"maintainers": [
{
"email": "sklein12@gmail.com",
"name": "sklein12"
},
{
"email": "michael.l.dangelo@gmail.com",
"name": "mdangelo"
},
{
"email": "ianw_npm@ianww.com",
"name": "ianw"
},
{
"email": "justin.beckwith@gmail.com",
"name": "justinbeckwith"
},
{
"email": "faizan1030@gmail.com",
"name": "faizanminhas"
}
],
"num_versions": 411,
"repository": {
"type": "git",
"url": "git+https://github.com/promptfoo/promptfoo.git"
},
"scripts": {
"architecture:check": "tsx scripts/checkArchitectureBoundaries.ts",
"audit:fix": "npm audit fix && npm audit fix --prefix src/app && npm audit fix --prefix site",
"bin": "dist/src/entrypoint.js",
"build": "concurrently -g --kill-others-on-fail \"npm run tsc\" \"NODE_OPTIONS='--max-old-space-size=8192' tsdown\" \"npm run build:app\"",
"build:app": "npm run build --prefix src/app",
"build:clean": "shx rm -rf dist",
"build:watch": "NODE_OPTIONS='--max-old-space-size=8192' tsdown --watch",
"changelog:release": "node scripts/update-changelog-version.cjs",
"check:typescript-coverage": "tsx scripts/checkTypeScriptCoverage.ts",
"citation:generate": "tsx scripts/generateCitation.ts",
"db:generate": "npx drizzle-kit generate",
"db:migrate": "tsx src/migrate.ts",
"db:studio": "npx drizzle-kit studio",
"depcheck": "depcheck --ignores=\"@types/*,@biomejs/biome,prettier,shx,concurrently,madge,knip,vite,typescript,tshy,gcp-metadata,@opencode-ai/sdk,@actions/core,@actions/exec,@actions/github,@octokit/rest,nock,@vitest/coverage-v8,langium\" --ignore-dirs=\"dist,site,examples\"",
"deps:ownership": "tsx scripts/reportDependencyOwnership.ts",
"dev": "concurrently \"npm run dev:server\" \"npm run dev:app\"",
"dev:app": "npm run dev --prefix src/app",
"dev:server": "tsx watch src/server/index.ts",
"f": "git diff --name-only --diff-filter=ACMRTUXB origin/main | grep -E '\\.(js|jsx|mjs|cjs|ts|tsx|json)$' | xargs npx @biomejs/biome check --write && git diff --name-only --diff-filter=ACMRTUXB origin/main | grep -E '\\.(css|scss|html|md|mdc|mdx|yaml|yml)$' | xargs prettier --write",
"format": "npx @biomejs/biome check --write . && prettier --write '**/*.{css,scss,html,md,mdc,mdx,yaml,yml}'",
"format:check": "npx @biomejs/biome check && prettier --check '**/*.{css,scss,html,md,mdc,mdx,yaml,yml}'",
"format:check:prettier": "prettier --check '**/*.{css,scss,html,md,mdc,mdx,yaml,yml}'",
"jsonSchema:generate": "npx -y tsx scripts/generateJsonSchema.ts > site/static/config-schema.json && npx @biomejs/biome format --write site/static/config-schema.json",
"knip": "knip",
"l": "git diff --name-only --diff-filter=ACMRTUXB origin/main | grep -E '\\.(js|ts|tsx)$' | xargs npx @biomejs/biome lint --write",
"lint": "npm run lint:src",
"lint:ci": "npx @biomejs/biome ci .",
"lint:site": "npx @biomejs/biome lint site",
"lint:src": "npx @biomejs/biome lint src",
"lint:tests": "npx @biomejs/biome lint test",
"local": "tsx src/main.ts",
"local:web": "npm run dev --prefix src/app",
"mcp": "node dist/src/entrypoint.js mcp",
"openapi:check": "tsx scripts/generateOpenApi.ts --check",
"openapi:generate": "tsx scripts/generateOpenApi.ts",
"postbuild": "tsx scripts/postbuild.ts",
"postversion": "npm run changelog:release && npm run citation:generate && git add CHANGELOG.md CITATION.cff && git commit --amend --no-edit && gh pr create --repo promptfoo/promptfoo --title \"chore: bump version $npm_package_version\" --body \"\"",
"prepare": "husky || exit 0",
"prepublishOnly": "node -e \"if (!process.env.PROMPTFOO_POSTHOG_KEY) { console.error('Error: PROMPTFOO_POSTHOG_KEY must be set'); process.exit(1); }\" && npm run build:clean && npm run build",
"preversion": "command -v gh >/dev/null 2>&1 || (echo \"Error: GitHub CLI required.\" && exit 1) && [ \"$(git rev-parse --abbrev-ref HEAD)\" = \"main\" ] || (echo \"Error: Must be on main branch to version\" && exit 1) && git pull origin main && git checkout -b \"chore/bump-version-$(date +%s)\"",
"storybook": "npm run storybook --prefix src/app",
"test": "vitest run",
"test:app": "npm --prefix src/app run test --",
"test:app:browser": "npm --prefix src/app run test:browser --",
"test:coverage": "vitest run --coverage && npm run test:coverage --prefix src/app",
"test:coverage:ratchet": "node --import tsx ./scripts/checkCoverageRatchets.ts",
"test:integration": "vitest run --config vitest.integration.config.ts",
"test:redteam:integration": "npm run build && ./test/redteam/integration/test.sh",
"test:site": "npm run test --prefix site",
"test:smoke": "vitest run --config vitest.smoke.config.ts",
"test:vitest": "vitest run",
"test:vitest:watch": "vitest",
"test:watch": "vitest",
"tsc": "tsc --noEmit"
},
"signal_details": {
"dependency_added_unknown": "2 new non-watchlisted dep(s): ['@inquirer/search', '@libsql/client']",
"mass_publish_burst": "publisher 'GitHub Actions' pushed 286 packages in the last 15min on npm"
},
"time": {
"created": "2023-05-03T19:53:10.282Z",
"modified": "2026-05-28T23:59:40.582Z"
}
}