
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
A TypeScript library to access your python functions in NodeJS, type-safe and easy to use.
This is especially useful if you want to use machine learning models in NodeJS.
# File: script.py
from typing import List
def word_sizes(words: List[str]) -> List[int]:
return [len(word) for word in words]
// File: app.ts
import {PyBridge} from 'pybridge';
const bridge = new PyBridge({python: 'python3', cwd: __dirname});
interface API {
word_sizes(words: string[]): number[];
}
const api = bridge.controller<API>('script.py');
const sizes = await api.word_sizes(['hello', 'world']);
expect(sizes).toEqual([5, 5]);
bridge.close();
If you use Deepkit Framework, you can PyBridgeModule:
const app = new App({
imports: [new PyBridgeModule({
python: 'python3',
cwd: __dirname,
})]
}).command('test', async (python: PyBridge) => {
interface API {
word_sizes(words: string[]): number[];
}
const controller = python.controller<API>('script.py');
const sizes = await controller.word_sizes(['hello', 'world']);
expect(sizes).toEqual([5, 5]);
});
app.run();
In order to not pass the controller type to the controller function all the time, you can prepare your own controller clas like that
// file: python-controller.ts
interface API {
word_sizes(words: string[]): number[];
}
interface NLP {
embed(text: string): number[];
}
class PythonController {
script = this.python.controller<API>('script.py');
nlp = this.python.controller<NLP>('nlp.py');
constructor(protected python: PyBridge) {
}
}
And then use PythonController everywhere.
from sentence_transformers import SentenceTransformer
embedder = SentenceTransformer('paraphrase-MiniLM-L6-v2') # 90MB model
def embed(sentence):
# important to convert to list so json.dumps works
return embedder.encode(sentence).tolist()
def batch_embed(sentences):
for sentence in sentences:
yield embed(sentence).tolist()
interface ML {
// Return type will be Promise<number[]>
embed(text: string): number[];
// Return type stays Subject, so values of `yield` will be streamed until the function is finished
batch_embed(text: string[]): Subject<number[]>;
}
class PythonController {
ml = this.python.controller<ML>('nlp.py');
constructor(protected python: PyBridge) {
}
}
const controller = new PythonController(bridge);
const embedding = await controller.ml.embed('hello world');
const stream = await controller.ml.batch_embed(['lots', 'of', 'sentences']);
stream.subscribe((embedding) => {
console.log('Got embedding', embedding);
});
await stream.toPromise(); // wait until stream is finished
Alternatively instead of providing a module name script path, you can also provide a Python code directly:
const code = `
def embed(text):
return [len(text)]
`;
const controller = python.controller<API>(code);
First install pybridge using npm:
npm install pybridge
Then install Deepkit (needed for type-safe data serialization between NodeJS and Python):
npm install --save-dev @deepkit/type-compiler
Enable Deepkit runtime type reflection:
File: tsconfig.json
{
"compilerOptions": {
// ...
},
"reflection": true
}
PyBridge starts a Python process and communicates with it via stdin/stdout. It uses Deepkit to serialize data between the two processes.
It's important to type the API controller in TypeScript correctly, so Deepkit can serialize and deserialize the data correctly. Make sure it matches the Python function signature.
FAQs
TypeScript library for Python interop
The npm package pybridge receives a total of 57 weekly downloads. As such, pybridge popularity was classified as not popular.
We found that pybridge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.