
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
**QVAC SDK** is the canonical entry point to develop AI applications with QVAC.
QVAC SDK is the canonical entry point to develop AI applications with QVAC.
QVAC SDK is the main entry point for developing applications with QVAC. It is type-safe and exposes all QVAC capabilities through a unified interface. It runs on Node.js, Bare runtime, and Expo.
See https://docs.qvac.tether.io/sdk/getting-started for the comprehensive QVAC documentation.
See https://docs.qvac.tether.io/sdk/getting-started/installation
mkdir qvac-examples
cd qvac-examples
npm init -y && npm pkg set type=module
npm install @qvac/sdk
import { loadModel, LLAMA_3_2_1B_INST_Q4_0, completion, unloadModel, } from "@qvac/sdk";
try {
// Load a model into memory
const modelId = await loadModel({
modelSrc: LLAMA_3_2_1B_INST_Q4_0,
modelType: "llm",
onProgress: (progress) => {
console.log(progress);
},
});
// You can use the loaded model multiple times
const history = [
{
role: "user",
content: "Explain quantum computing in one sentence",
},
];
const result = completion({ modelId, history, stream: true });
for await (const token of result.tokenStream) {
process.stdout.write(token);
}
// Unload model to free up system resources
await unloadModel({ modelId });
}
catch (error) {
console.error("❌ Error:", error);
process.exit(1);
}
node quickstart.js
In the ./examples subdirectory, you will find scripts demonstrating how to use all SDK functionalities. To try any of them:
# With Bare
bun run bare:example dist/examples/path/to/example.js
# With Node
node dist/examples/path/to/example.js
# With bun, straight from source
bun run examples/path/to/example.ts
Use the Bun package manager:
bun i
bun run build # or `watch` for hotreload
bun run build:pack
This outputs a tarball under dist/sdk-{version}.tgz that you can install in your project, e.g.:
npm i path/to/sdk-0.3.0.tgz
This repository enforces structured commit messages and PR titles to maintain consistency and generate changelogs automatically.
Commit messages:
prefix[tags]?: subject
PR titles:
TICKET prefix[tags]: subject
feat - New features or capabilitiesfix - Bug fixesdoc - Documentation changestest - Test additions or modificationsmod - Model-related changeschore - Maintenance tasksinfra - CI/CD, tooling, infrastructureTags are optional:
[api] - API changes (non-breaking)[bc] - Breaking changes (including breaking API changes)Valid commit messages:
feat: add RAG support for LanceDB
fix[api]: fix completion stream error handling
doc: update installation instructions
feat[bc]: redesign loadModel signature
chore: update dependencies
Valid PR titles:
QVAC-123 feat: add RAG support for LanceDB
QVAC-456 fix[api]: fix completion stream error handling
QVAC-789 doc: update installation instructions
QVAC-101 feat[bc]: redesign loadModel signature
When creating PRs with specific tags, you must include code examples in the PR description:
[bc] tag requirements:
Must include BEFORE/AFTER code examples showing the migration path:
## BC Changes
**BEFORE:**
```typescript
const model = await loadModel("model-path");
```
**AFTER:**
```typescript
const modelId = await loadModel("model-path", { modelType: "llm" });
```
Or using inline comments:
```typescript
// old
const model = await loadModel("model-path");
// new
const modelId = await loadModel("model-path", { modelType: "llm" });
```
[api] tag requirements (non-breaking):
Must include at least one fenced code block showing the new API usage:
## New API
```typescript
// New completion API with streaming support
for await (const token of completion({
modelId,
history: [{ role: "user", content: "Hello!" }],
}).tokenStream) {
process.stdout.write(token);
}
```
Merge pull request #123)1.0.0, v1.0.0)Revert "feat: add feature")squash! fix: bug fix)Once your PRs are merged into dev, you can generate a changelog:
npm run changelog:generate
This will:
dev and main brancheschangelog/<version>/CHANGELOG.mdchangelog/<version>/breaking.md for BC changes (with code examples)changelog/<version>/api.md for API changes (with code examples)FAQs
**QVAC SDK** is the canonical entry point to develop AI applications with QVAC.
The npm package @qvac/sdk receives a total of 186 weekly downloads. As such, @qvac/sdk popularity was classified as not popular.
We found that @qvac/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.