
Security News
Feross on TBPN: How North Korea Hijacked Axios
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.
This is a project of mine that as of 28.05.2025 I've been working on for about 4 months (since 27.01.2025). This is a transformer architecture with pre-training and training implemented in pure javascript. It only requires tiktoken for tokenization, readline-sync for the interactive console mode, uuid for random string generation, zip librairies (archiver and yauzl) to load/save models and ws for future remote device support. No ml (machine learning) librairies like pytorch or tensorflow. Only pure raw javascript and no abstractions.
Look at the guide: guide
Absolutely, normally it should be as fast as pytorch or tensorflow for cpu only training/pre-training/inference. It will work and it will be easier to use than tensorflow or pytorch too.
Because:
I wanted to see how this actually works therefore I decided to put Claude, Chatgpt and Gemini to work to teach me how all of this works, I also used them to implement some parts of the code like training, pre-training and other stuff but I generally understand how it works now. Because this works and this is really cool I am releasing it on github publicly :)
My model is still training, I will give you guys an example of a good model when mine finishes training. If you're from the github repo and look at the commit history you'll see there was an example previously here, I just removed it because since I made and put here that example I changed and fixed lots of things in how the training logic works therefore that example is now innacurate.
Here's a small list of things I'll add:
To support this project you can star the repo and you can send me suggestions through discord (willmil11) or email (willmil111012@gmail.com). Please don't create pull requests as this is a project of mine to learn I therefore want to code and implement everything myself, even if your suggestions are welcome, I want to implement them myself.
I'm William, a 14 yo french programmer and this is my most ambitious project yet. It took an insane amount of planning, coding and debugging but it was sooo worth it.
If you're on the npm page, check out and perhaps star the repo
Refer to the deprecated readme
Note: Next Nightly version (2.0.0 Nightly 4) will be uploaded as a nightly then directly as a stable as it will aim to break into chunks some of the functions in worker.js to stop running out of turbofan zone memory which would have for effect to allow me to remove the --no-opt flag from the worker spawn and therefore boost the speed by about 30% which would make the local multithreading as good as it can be and therefore make it a stable version. << This was a very bad idea and made the code about 339% slower, for this 2.0.0 Nightly 4, I simply realized everything was perfect, added a safety check for the optional noSweetSpotSaving config option and shipped.
The license for this code is the MIT License.
FAQs
A fully standalone, terminal-based AI model CLI for training and inference
We found that cleanai demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.

Security News
OpenSSF has issued a high-severity advisory warning open source developers of an active Slack-based campaign using impersonation to deliver malware.

Research
/Security News
Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.