
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

The AI SDK is a TypeScript toolkit designed to help you build AI-powered applications and agents using popular frameworks like Next.js, React, Svelte, Vue and runtimes like Node.js.
To learn more about how to use the AI SDK, check out our API Reference and Documentation.
You will need Node.js 18+ and npm (or another package manager) installed on your local development machine.
npm install ai
The AI SDK provides a unified API to interact with model providers like OpenAI, Anthropic, Google, and more.
npm install @ai-sdk/openai @ai-sdk/anthropic @ai-sdk/google
Alternatively you can use the Vercel AI Gateway.
import { generateText } from 'ai';
const { text } = await generateText({
model: 'openai/gpt-5', // use Vercel AI Gateway
prompt: 'What is an agent?',
});
import { generateText } from 'ai';
import { openai } from '@ai-sdk/openai';
const { text } = await generateText({
model: openai('gpt-5'), // use OpenAI Responses API directly
prompt: 'What is an agent?',
});
import { generateObject } from 'ai';
import { z } from 'zod';
const { object } = await generateObject({
model: 'openai/gpt-5',
schema: z.object({
recipe: z.object({
name: z.string(),
ingredients: z.array(z.object({ name: z.string(), amount: z.string() })),
steps: z.array(z.string()),
}),
}),
prompt: 'Generate a lasagna recipe.',
});
The AI SDK UI module provides a set of hooks that help you build chatbots and generative user interfaces. These hooks are framework agnostic, so they can be used in Next.js, React, Svelte, and Vue.
You need to install the package for your framework, e.g.:
npm install @ai-sdk/react
'use client';
import { useState } from 'react';
import { useChat } from '@ai-sdk/react';
export default function Page() {
const { messages, status, sendMessage } = useChat();
const [input, setInput] = useState('');
const handleSubmit = e => {
e.preventDefault();
sendMessage({ text: input });
setInput('');
};
return (
<div>
{messages.map(message => (
<div key={message.id}>
<strong>{`${message.role}: `}</strong>
{message.parts.map((part, index) => {
switch (part.type) {
case 'text':
return <span key={index}>{part.text}</span>;
// other cases can handle images, tool calls, etc
}
})}
</div>
))}
<form onSubmit={handleSubmit}>
<input
value={input}
placeholder="Send a message..."
onChange={e => setInput(e.target.value)}
disabled={status !== 'ready'}
/>
</form>
</div>
);
}
import { streamText } from 'ai';
import { openai } from '@ai-sdk/openai';
export async function POST(req: Request) {
const { messages } = await req.json();
const result = streamText({
model: openai('gpt-4o'),
system: 'You are a helpful assistant.',
messages,
});
return result.toUIMessageStreamResponse();
}
We've built templates that include AI SDK integrations for different use cases, providers, and frameworks. You can use these templates to get started with your AI-powered application.
The AI SDK community can be found on the Vercel Community where you can ask questions, voice ideas, and share your projects with other people.
Contributions to the AI SDK are welcome and highly appreciated. However, before you jump right into it, we would like you to review our Contribution Guidelines to make sure you have smooth experience contributing to AI SDK.
This library is created by Vercel and Next.js team members, with contributions from the Open Source Community.
FAQs
AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.
The npm package ai receives a total of 2,353,608 weekly downloads. As such, ai popularity was classified as popular.
We found that ai demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.