
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@ts-dspy/core
Advanced tools
Core library for building type-safe LLM applications with structured input/output signatures, automatic validation, and reasoning patterns within TypeScript
Core library for building type-safe LLM applications with structured input/output signatures, automatic validation, and reasoning patterns.
TS-DSPy brings the power of DSPy to TypeScript, enabling you to build robust, composable, and type-safe LLM applications with structured prompting and automatic optimization.
npm install @ts-dspy/core
# Install ts-node for proper execution (recommended)
npm install -g ts-node
⚠️ Important: Use ts-node to run TypeScript files directly. Transpiling to JavaScript may cause issues with decorators and type information.
# Run your scripts with ts-node
npx ts-node your-script.ts
# Or install globally and use directly
npm install -g ts-node
ts-node your-script.ts
For LLM provider integrations:
# OpenAI integration
npm install @ts-dspy/core @ts-dspy/openai
# Google Gemini integration
npm install @ts-dspy/core @ts-dspy/gemini
# Both providers
npm install @ts-dspy/core @ts-dspy/openai @ts-dspy/gemini
import { Signature, InputField, OutputField } from '@ts-dspy/core';
class QuestionAnswering extends Signature {
static description = "Answer questions based on given context";
@InputField({ description: "The question to answer" })
question!: string;
@InputField({ description: "Context information" })
context!: string;
@OutputField({ description: "The answer to the question" })
answer!: string;
@OutputField({ description: "Confidence score", type: "number" })
confidence!: number;
}
import { Predict, configure } from '@ts-dspy/core';
import { OpenAILM } from '@ts-dspy/openai';
// or import { GeminiLM } from '@ts-dspy/gemini';
// Configure your language model
configure({
lm: new OpenAILM({
apiKey: process.env.OPENAI_API_KEY,
model: 'gpt-4'
})
// Or use Gemini:
// lm: new GeminiLM({
// apiKey: process.env.GEMINI_API_KEY,
// model: 'gemini-2.0-flash'
// })
});
// Create a prediction module
const qa = new Predict(QuestionAnswering);
// Use it
const result = await qa.forward({
question: "What is the capital of France?",
context: "France is a country in Europe. Its capital city is Paris."
});
console.log(result.answer); // "Paris"
console.log(result.confidence); // 0.95
import { Predict } from '@ts-dspy/core';
const summarizer = new Predict("text -> summary");
const result = await summarizer.forward({
text: "Long text to summarize..."
});
console.log(result.summary);
Signatures define the structure of your LLM interactions:
class MySignature extends Signature {
@InputField({ description: "Input description", required: true })
input!: string;
@OutputField({ description: "Output description", type: "string" })
output!: string;
}
Field Options:
description: Human-readable description for the LLMtype: TypeScript type (string, number, boolean, etc.)required: Whether the field is required (default: true)prefix: Custom prefix for promptsModules are the building blocks of TS-DSPy applications:
const predictor = new Predict("context, question -> answer");
const result = await predictor.forward({
context: "The sky is blue because of Rayleigh scattering.",
question: "Why is the sky blue?"
});
import { ChainOfThought } from '@ts-dspy/core';
const reasoner = new ChainOfThought("problem -> solution: int");
const result = await reasoner.forward({
problem: "If I have 3 apples and buy 5 more, then eat 2, how many do I have?"
});
console.log(result.reasoning); // "First I have 3 apples..."
console.log(result.solution); // 6
import { RespAct } from '@ts-dspy/core';
const agent = new RespAct("question -> answer", {
tools: {
calculate: {
description: "Performs mathematical calculations",
function: (expr: string) => eval(expr)
},
search: {
description: "Searches for information online",
function: async (query: string) => await searchWeb(query)
}
},
maxSteps: 5
});
import { Example } from '@ts-dspy/core';
const examples = [
new Example({
question: "What is 2+2?",
answer: "4",
explanation: "Simple addition"
}).withInputs("question"),
new Example({
question: "What is the capital of Spain?",
answer: "Madrid",
explanation: "Madrid is the capital and largest city of Spain"
}).withInputs("question")
];
// Use examples in your modules
const predictor = new Predict(MySignature);
// Examples can be used for few-shot prompting or optimization
TS-DSPy features an advanced tool system with intelligent descriptions:
const financialAgent = new RespAct("question -> answer", {
tools: {
fetchStockPrice: {
description: "Retrieves current stock price for a ticker symbol (e.g., AAPL, GOOGL). Returns price in USD. Use when you need current market data.",
function: async (symbol: string) => {
const response = await fetch(`/api/stocks/${symbol}`);
return response.json();
}
},
calculatePortfolioValue: {
description: "Calculates total portfolio value given holdings. Takes array of {symbol, shares} objects. Use for portfolio analysis.",
function: (holdings: Array<{symbol: string, shares: number}>) => {
return holdings.reduce((total, holding) =>
total + (getStockPrice(holding.symbol) * holding.shares), 0
);
}
}
}
});
import { configure } from '@ts-dspy/core';
import { OpenAILM } from '@ts-dspy/openai';
// Global configuration
configure({
lm: new OpenAILM({
apiKey: process.env.OPENAI_API_KEY,
model: 'gpt-4'
}),
cache: true,
tracing: true
});
Implement the ILanguageModel interface:
import { ILanguageModel, UsageStats } from '@ts-dspy/core';
class MyCustomLM implements ILanguageModel {
async generate(prompt: string): Promise<string> {
// Your implementation
}
async getUsageStats(): Promise<UsageStats> {
// Return usage statistics
}
}
const step1 = new Predict("question -> research_query");
const step2 = new Predict("research_query -> answer");
// Chain the operations
const query = await step1.forward({ question: "How does photosynthesis work?" });
const answer = await step2.forward({ research_query: query.research_query });
import { OpenAILM } from '@ts-dspy/openai';
const lm = new OpenAILM({ apiKey: process.env.OPENAI_API_KEY });
const module = new Predict("question -> answer", lm);
await module.forward({ question: "Hello world!" });
// Get detailed usage statistics
const usage = lm.getUsage();
console.log(`Tokens: ${usage.totalTokens}`);
console.log(`Cost: $${usage.totalCost}`);
console.log(`Requests: ${usage.requestCount}`);
Signature: Base class for defining input/output schemasModule: Base class for all TS-DSPy modulesPredict: Basic prediction moduleChainOfThought: Reasoning module with step-by-step thinkingRespAct: Tool-using agent moduleExample: Data structure for examples and demonstrationsPrediction: Wrapper for module outputs@InputField(options): Marks a field as input@OutputField(options): Marks a field as outputconfigure(options): Global configurationbuildPrompt(signature, inputs): Build prompts from signaturesparseOutput(signature, output): Parse LLM outputsWe welcome contributions! Please see our Contributing Guide for details.
MIT License - see the LICENSE file for details.
@ts-dspy/openai - OpenAI integrationFAQs
Core library for building type-safe LLM applications with structured input/output signatures, automatic validation, and reasoning patterns within TypeScript
We found that @ts-dspy/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.