
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@tensorflow/tfjs-core
Advanced tools
Hardware-accelerated JavaScript library for machine intelligence
A part of the TensorFlow.js ecosystem, this repo hosts @tensorflow/tfjs-core,
the TensorFlow.js Core API, which provides low-level, hardware-accelerated
linear algebra operations and an eager API for automatic differentiation.
Check out js.tensorflow.org for more information about the library, tutorials and API docs.
To keep track of issues we use the tensorflow/tfjs Github repo.
You can install TensorFlow.js via yarn or npm. We recommend using the @tensorflow/tfjs npm package, which gives you both this Core API and the higher-level Layers API:
import * as tf from '@tensorflow/tfjs';
// You have the Core API: tf.matMul(), tf.softmax(), ...
// You also have Layers API: tf.model(), tf.layers.dense(), ...
On the other hand, if you care about the bundle size and you do not use the Layers API, you can import only the Core API:
import * as tfc from '@tensorflow/tfjs-core';
// You have the Core API: tfc.matMul(), tfc.softmax(), ...
// No Layers API.
Note: If you are only importing the Core API, you also need to import a backend (e.g., tfjs-backend-cpu, tfjs-backend-webgl, tfjs-backend-wasm).
For info about development, check out DEVELOPMENT.md.
Thanks BrowserStack for providing testing support.
ONNX.js is a JavaScript library for running ONNX (Open Neural Network Exchange) models in the browser and Node.js. It provides similar functionalities for running pre-trained models but focuses on the ONNX model format, which is widely used for interoperability between different machine learning frameworks.
Brain.js is a JavaScript library for neural networks, which can be used in Node.js and the browser. It provides a simpler API compared to @tensorflow/tfjs-core and is more focused on ease of use for common neural network tasks, but it may not offer the same level of flexibility and performance.
FAQs
Hardware-accelerated JavaScript library for machine intelligence
The npm package @tensorflow/tfjs-core receives a total of 550,770 weekly downloads. As such, @tensorflow/tfjs-core popularity was classified as popular.
We found that @tensorflow/tfjs-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 10 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.