
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
recursive-lm
Advanced tools
Process arbitrarily long contexts by recursively decomposing prompts — based on the Recursive Language Models paper
Process arbitrarily long contexts by recursively decomposing prompts — based on the Recursive Language Models paper.
Traditional LLMs have a fixed context window. When your document exceeds it, you lose information. Recursive LM solves this by treating the prompt as an external environment and letting the model programmatically decompose and recursively process it.
The model gets a REPL interface with three tools:
read(start, end) — read a character range from the documentllm_query(query, context) — spawn a recursive sub-call to process a chunkFINAL(answer) — return the final answerThis enables divide-and-conquer strategies where the model automatically chunks, summarizes, and synthesizes — processing documents of 1M+ tokens with models that only have 32k-128k context windows.
npm install recursive-lm
import { RecursiveLM } from 'recursive-lm';
import type { LLMProvider, Message } from 'recursive-lm';
// 1. Implement the provider interface for your LLM
class MyProvider implements LLMProvider {
async generate(messages: Message[]): Promise<string> {
// Call OpenAI, Anthropic, local model, etc.
const response = await callYourLLM(messages);
return response;
}
}
// 2. Create the RecursiveLM instance
const rlm = new RecursiveLM({
provider: new MyProvider(),
maxDepth: 5, // max recursion depth
chunkSize: 8000, // characters per chunk
maxIterations: 20, // max loop iterations
});
// 3. Query any length document
const answer = await rlm.query(
'What are the key findings?',
veryLongDocument // can be millions of characters
);
RecursiveLMThe main class. Wires together Environment, Scaffold, and Sandbox.
new RecursiveLM(config: RLMConfig)
| Option | Type | Default | Description |
|---|---|---|---|
provider | LLMProvider | required | Your LLM adapter |
maxDepth | number | 5 | Max recursion depth for llm_query() |
chunkSize | number | 8000 | Chunk size in characters |
maxIterations | number | 20 | Max scaffold loop iterations |
onStep | (e: StepEvent) => void | — | Called on each loop iteration |
onRecurse | (e: RecurseEvent) => void | — | Called on recursive sub-calls |
onFinal | (e: FinalEvent) => void | — | Called when answer is produced |
query(question, context) — Process a single documentqueryMultiDoc(question, documents) — Process multiple named documentsqueryWithEnvironment(question, environment) — Use a pre-configured EnvironmentLLMProvider Interfaceinterface LLMProvider {
generate(messages: Message[]): Promise<string>;
}
interface Message {
role: 'system' | 'user' | 'assistant';
content: string;
}
For fine-grained control, use the components directly:
import { Environment, Scaffold, Sandbox } from 'recursive-lm';
const env = new Environment(8000);
env.addDocument('report', longText);
const scaffold = new Scaffold({
provider: myProvider,
maxDepth: 5,
maxIterations: 20,
});
const answer = await scaffold.run('Summarize the report', env);
Based on Algorithm 1 from the paper:
1. Initialize: History H ← [system prompt, user query]
2. Loop:
a. Call LLM(H) → response
b. If response contains FINAL(answer) → return answer
c. If response contains ```repl code:
- Execute code (read, llm_query, etc.)
- Append results to H
d. Repeat
The model learns to perform parallel mapping (processing chunks in parallel recursive calls) and hierarchical reduction (combining summaries into higher-level summaries) — automatically adapting its strategy to the query.
MIT
FAQs
Process arbitrarily long contexts by recursively decomposing prompts — based on the Recursive Language Models paper
We found that recursive-lm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.