
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
TypeScript package for predictive data analysis, data preparation and machine learning.
Aims to be a Typescript port of the scikit-learn python library.
This library is for users who wish to train or deploy their models to JS environments (browser, mobile) but with a familiar API.
Generic math operations are powered by Tensorflow.js core layer for faster calculation.
Documentation site: www.scikitjs.org
For use with modern bundlers in a frontend application, simply
npm i @tensorflow/tfjs scikitjs
We depend on the tensorflow library in order to make our calculations fast, but we don't ship it in our bundle. We use it as a peer dependency. General usage is as follows.
import * as tf from '@tensorflow/tfjs'
import * as sk from 'scikitjs'
sk.setBackend(tf)
This allows us to build a library that can be used in Deno, Node, and the browser with the same configuration.
For Node.js users who wish to bind to the Tensorflow C++ library, simply import the tensorflow C++ version, and use that as the tf library
npm i @tensorflow/tfjs-node scikitjs
const tf = require('@tensorflow/tfjs-node')
const sk = require('scikitjs')
sk.setBackend(tf)
Note: If you have ESM enabled (by setting type="module" in your package.json), then you can consume this library with import / export, like in the following code block.
import * as tf from '@tensorflow/tfjs-node'
import * as sk from 'scikitjs'
sk.setBackend(tf)
For those that wish to use script src tags, simply
<script type="module">
import * as tf from 'https://cdn.skypack.dev/@tensorflow/tfjs'
import * as sk from 'https://cdn.skypack.dev/scikitjs'
sk.setBackend(tf)
// or alternatively you can pull the bundle from unpkg
// import * as sk from "https://unpkg.com/scikitjs/dist/web index.min.js"
</script>
import * as tf from '@tensorflow/tfjs'
import { setBackend, LinearRegression } from 'scikitjs'
setBackend(tf)
const lr = new LinearRegression({ fitIntercept: false })
const X = [[1], [2]] // 2D Matrix with a single column vector
const y = [10, 20]
await lr.fit(X, y)
lr.predict([[3], [4]]) // roughly [30, 40]
console.log(lr.coef)
console.log(lr.intercept)
This library aims to be a drop-in replacement for scikit-learn but for JS environments. There are some differences in deploy environment and underlying libraries that make for a slightly different experience. Here are the 3 main differences.
While I would have liked to make every function identical to the python equivalent, it wasn't possible. In python, one has named arguments, meaning that all of these are valid function calls.
def myAdd(a=0, b=100):
return a+b
print(myAdd()) # 100
print(myAdd(a=10)) # 110
print(myAdd(b=10)) # 10
print(myAdd(b=20, a=20)) # 40 (order doesn't matter)
print(myAdd(50,50)) # 100
Javascript doesn't have named parameters, so one must choose between positional arguments, or passing in a single object with all the parameters.
For many classes in scikit-learn, the constructors take in a ton of arguments with sane defaults, and the user usually only specifies which one they'd like to change. This rules out the positional approach.
After a class is created most function calls really only take in 1 or 2 arguments (think fit, predict, etc). In that case, I'd rather simply pass them positionally. So to recap.
from sklearn.linear_model import LinearRegression
X, y = [[1],[2]], [10, 20]
lr = LinearRegression(fit_intercept = False)
lr.fit(X, y)
Turns into
import * as tf from '@tensorflow/tfjs'
import { setBackend, LinearRegression } from 'scikitjs'
setBackend(tf)
let X = [[1], [2]]
let y = [10, 20]
let lr = new LinearRegression({ fitIntercept: false })
await lr.fit(X, y)
You'll also notice in the code above, these are actual classes in JS, so you'll need to new them.
Not a huge change, but every function call and variable name that is underscore_case in python will simply be camelCase in JS. In cases where there is an underscore but no word after, it is removed.
from sklearn.linear_model import LinearRegression
X, y = [[1],[2]], [10, 20]
lr = LinearRegression(fit_intercept = False)
lr.fit(X, y)
print(lr.coef_)
Turns into
import * as tf from '@tensorflow/tfjs'
import { setBackend, LinearRegression } from 'scikitjs'
setBackend(tf)
let X = [[1], [2]]
let y = [10, 20]
let lr = new LinearRegression({ fitIntercept: false })
await lr.fit(X, y)
console.log(lr.coef)
In the code sample above, we see that fit_intercept turns into fitIntercept (and it's an object). And coef_ turns into coef.
It's common practice in Javascript to not tie up the main thread. Many libraries, including tensorflow.js only give an async "fit" function.
So if we build on top of them our fit functions will be asynchronous. But what happens if we make our own estimator that has a synchronous fit function? Should we burden the user with finding out if their fit function is async or not, and then "awaiting" the proper one? I think not.
I think we should simply await all calls to fit. If you await a synchronous function, it resolves immediately and you are on your merry way. So I literally await all calls to .fit and you should too.
from sklearn.linear_model import LogisticRegression
X, y = [[1],[-1]], [1, 0]
lr = LogisticRegression(fit_intercept = False)
lr.fit(X, y)
print(lr.coef_)
Turns into
import * as tf from '@tensorflow/tfjs'
import { setBackend, LogisticRegression } from 'scikitjs'
setBackend(tf)
let X = [[1], [-1]]
let y = [1, 0]
let lr = new LogisticRegression({ fitIntercept: false })
await lr.fit(X, y)
console.log(lr.coef)
See guide
FAQs
Scikit-Learn for JS
The npm package scikitjs receives a total of 147 weekly downloads. As such, scikitjs popularity was classified as not popular.
We found that scikitjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.