
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
Local LLM inference on macOS using a Swift MLX host process + a TypeScript client / AI SDK provider.
This README is shown on the npm package page. The repo contains additional development notes.
Requirements
darwin/arm64)Install
npm i mlx-ts
During install, mlx-ts downloads a prebuilt mlx-host (Swift) binary + mlx.metallib from GitHub Releases (no Xcode required).
Use with the AI SDK
import { createMlxProvider } from "mlx-ts";
import { generateText, streamText } from "ai";
const modelId = "mlx-community/Llama-3.2-1B-Instruct-4bit";
const mlx = createMlxProvider({
model: modelId,
// optional:
// modelsDir: "/tmp/mlx-ts-models",
// hostPath: process.env.MLX_HOST_BIN,
});
const model = mlx.languageModel(modelId);
// stream
const s = await streamText({
model,
maxTokens: 64,
messages: [{ role: "user", content: "Say hello from a local MLX model." }],
});
for await (const chunk of s.textStream) process.stdout.write(chunk);
process.stdout.write("\n");
// one-shot
const g = await generateText({
model,
maxTokens: 64,
messages: [{ role: "user", content: "Summarize MLX in one sentence." }],
});
console.log(g.text);
MLX_HOST_DEVICE=cpu (default is gpu).MLX_HOST_BIN=/path/to/mlx-host or pass { hostPath } to createMlxProvider.{ modelsDir } to createMlxProvider.mlx-ts downloads assets from: set MLX_TS_HOST_BASE_URL (base URL containing mlx-host and mlx.metallib).OpenCode supports OpenAI-compatible providers and allows setting options.baseURL (OpenCode Providers) and selecting models via provider_id/model_id (OpenCode Models).
mlx-ts ships a small OpenAI-compatible local server:
# Start local server (choose any MLX model id)
npx mlx-ts-opencode --model mlx-community/Llama-3.2-1B-Instruct-4bit --port 3755
# Generate an opencode.json snippet
npx mlx-ts-opencode --print-config --model mlx-community/Llama-3.2-1B-Instruct-4bit --port 3755 > opencode.json
FAQs
AI SDK provider for local MLX (Swift) models on Apple Silicon (macOS).
The npm package mlx-ts receives a total of 3 weekly downloads. As such, mlx-ts popularity was classified as not popular.
We found that mlx-ts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.