
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Minimal LLM framework for Node.js - Build AI agents and workflows with TypeScript
Minimal LLM framework for Node.js - Build complex AI agents and workflows with TypeScript. A lightweight, expressive alternative to heavy LLM frameworks.
npm install smallllm
git clone https://github.com/AnupKumarJha/small-llm.git
cd small-llm
npm install
npm run build
import { Node, Flow } from 'smallllm';
class HelloNode extends Node {
async exec(prepRes: any): Promise<any> {
return `Hello, ${prepRes.name}!`;
}
}
class PrintNode extends Node {
async post(shared: any, prepRes: any, execRes: any): Promise<string> {
console.log(execRes);
return 'default';
}
}
// Create and connect nodes
const hello = new HelloNode();
const print = new PrintNode();
hello.then(print);
// Create flow and run
const flow = new Flow(hello);
await flow.run({ name: 'World' });
import { LLMNode, Flow, LLMConfig } from 'smallllm';
const llmConfig: LLMConfig = {
provider: 'openai',
apiKey: process.env.OPENAI_API_KEY!,
model: 'gpt-4o'
};
class SummarizeNode extends LLMNode {
constructor() {
super(llmConfig, 'You are a helpful assistant that summarizes text.');
}
async prep(shared: any): Promise<any> {
return shared.text;
}
async exec(prepRes: any): Promise<any> {
const prompt = `Summarize this text:\n\n${prepRes}`;
return await this.callLLM(prompt);
}
}
const summarize = new SummarizeNode();
const flow = new Flow(summarize);
const result = await flow.run({ text: 'Your long text here...' });
console.log(result.summary);
import { Node, Flow, FileCheckpointer } from 'smallllm';
class ResearchAgent extends Node {
// Agent logic here...
}
// Enable checkpointing for crash recovery
const checkpointer = new FileCheckpointer('./checkpoints');
const flow = new Flow(researchAgent, { checkpointer });
// Run with unique flow ID for resume capability
const flowId = `research-${Date.now()}`;
await flow.run(sharedData, flowId);
// Later resume from checkpoint
await flow.run(sharedData, flowId);
Global data structure for node communication:
const shared = {
query: "What is AI?",
results: [],
finalAnswer: null
};
Run examples:
# Research agent
npm run research-agent
# Human-in-the-loop agent
npm run hitl-agent
# Resume functionality demo
npm run demo-resume
NodeBase node class for custom logic.
Methods:
prep(shared: SharedData): Promise<any> - Prepare input dataexec(prepRes: any): Promise<any> - Execute main logicpost(shared: SharedData, prepRes: any, execRes: any): Promise<Action> - Store resultssetParams(params: Params): void - Set node parametersLLMNodeNode with built-in LLM capabilities.
Constructor:
new LLMNode(llmConfig: LLMConfig, systemPrompt?: string)
Methods:
callLLM(prompt: string): Promise<string> - Make LLM callFlowWorkflow orchestrator.
Constructor:
new Flow(startNode: Node, options?: { checkpointer?: Checkpointer })
Methods:
run(shared: SharedData, flowId?: string): Promise<void> - Execute flowthen(node: Node): Flow - Chain nodes sequentiallyaction(actionName: string): Flow - Add conditional routingtype SharedData = Record<string, any>;
type Action = string | null | undefined;
type Params = Record<string, any>;
type LLMProvider = "openai" | "gemini" | "anthropic";
type LLMConfig = {
provider: LLMProvider;
apiKey: string;
model?: string;
temperature?: number;
maxTokens?: number;
};
See ARCHITECTURE.md for detailed design documentation.
git checkout -b feature/your-featurenpm testnpm install
npm run dev # Watch mode
npm run build
MIT License - see LICENSE file for details.
Inspired by PocketFlow - a similar framework for Python.
Built with ❤️ for the AI engineering community
FAQs
Minimal LLM framework for Node.js - Build AI agents and workflows with TypeScript
We found that smallllm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.