stdlib-js/stdlib: a numerical standard library for JavaScript and TypeScript

What stdlib solves, and who is meant to use it

JavaScript ships a small maths surface: Math, plus whatever a bundler or a native addon adds. There is no built-in gamma function, no normal distribution CDF, no seedable generator whose output you can reproduce across runs. stdlib fills that gap. The README describes it as "a standard library with an emphasis on numerical and scientific computation, written in JavaScript (and C) for execution in browsers and in Node.js".

The intended audience is stated through user stories rather than a persona list. One story covers people who want to do data analysis and data science in JavaScript and Node.js "similar to how I might use Python, Julia, R, and MATLAB", and the recommended route for them is installing the whole project as a command-line utility. A second story covers web application authors, who are pushed toward individual packages or custom bundles. Those two stories pull in opposite directions, and the rest of the installation section is essentially the project arbitrating between them.

The feature list is broad: 150+ special math functions, 35+ probability distributions with PDFs, CDFs, quantiles and moments, 40+ seedable PRNGs, 200+ general utilities, 200+ assertion utilities, 50+ sample datasets, a plot API, and native addons for BLAS libraries with pure JavaScript fallbacks. That last item matters more than it reads. It means the numerical kernels have a C path and a JavaScript path, and the JavaScript path exists so the same code runs where a compiled addon cannot.

The decomposable architecture and what it costs you

The README's central claim about the design is that stdlib has "a fully decomposable architecture, which allows you to swap out and mix and match APIs and functionality". In practice this is visible in the repository layout and in package.json. The root package @stdlib/stdlib declares dependencies on scoped packages such as @stdlib/array, @stdlib/assert, @stdlib/blas, @stdlib/complex, @stdlib/constants, @stdlib/datasets and @stdlib/random, each versioned independently. The documentation links point at namespaces like @stdlib/math/base/special, @stdlib/stats/base/dists and @stdlib/utils rather than at one monolith.

So the unit of installation is the namespace, not the library. That is a genuine architectural decision with a real cost: you have to know which namespace holds the function you want before you install anything. Someone who types Math. into an editor out of habit will not find the equivalent by guessing. The documentation is organised by namespace for exactly this reason, and the README's installation section is written as a decision tree rather than a single command.

The C side follows the same pattern. Native addons interface with BLAS libraries, and pure JavaScript fallbacks exist for environments where the addon will not build. The README does not state which functions fall back and which do not, so treat the addon as an optimisation you may or may not get, not as a guarantee.

Installing stdlib and running a first distribution calculation

The README defaults to npm and notes that other package managers should work by swapping the commands. The full library installs as the @stdlib/stdlib package, which also exposes a binary named stdlib through the bin field. That binary is the entry point for the command-line utility route the README recommends for data analysis work.

npm install @stdlib/stdlib

After that, the stdlib command is available. The package.json scripts show a repl target that runs make repl, and the feature list mentions a REPL environment with integrated help and examples, which is the fastest way to inspect a function before writing code against it.

npx stdlib

For a web application the README is explicit that installing the entire project is "likely unnecessary and will lead to slower installation times", and directs you to individual packages instead. The same dependency list that makes the monolith convenient makes it heavy. The repository also carries examples/index.js and examples/index.mjs, and a make examples target, which is where to look for a working invocation of a specific namespace rather than reconstructing one from the docs.

Where stdlib is the wrong choice

The clearest limitation is stated by the project itself in the installation section: for browser work, "installing the entire project is likely unnecessary and will lead to slower installation times". If your application needs one quantile function, pulling @stdlib/stdlib to get it is a misallocation, and the README would agree with you.

The second limitation is the dependency graph. The root package depends on a long list of scoped packages, each with its own version range. That is the price of decomposability, and it means an upgrade is not one version bump. The release history reinforces the point: v0.4.1 and v0.4.0 both landed on 2026-06-06, while the previous release, v0.3.2, is dated 2024-12-22. The last push to the default branch was on 2026-06-06. Between December 2024 and June 2026 there was a long quiet stretch, then two releases in the same minute. If your team needs a predictable release cadence to plan upgrades around, that pattern is worth studying before you depend on it.

Third, the licence is not a single identifier. package.json declares "Apache-2.0 AND BSL-1.0", while the repository description and the LICENSE file point at Apache-2.0. The AND means both sets of terms apply to the distributed work. Anyone who needs a clean single-licence answer should read LICENSE and NOTICE rather than trusting the repository header.

Finally, this is not a drop-in replacement for a numerical stack in another language. The README frames the goal as bringing numerical computing to the web, and the API surface is organised around that goal, not around NumPy or MATLAB compatibility.

How stdlib differs from Python's standard library and from C's stdlib.h

Most search traffic for the word "stdlib" is not about this project at all. Python's standard library and C's stdlib.h are the two meanings people usually have in mind, and the difference in approach is worth stating plainly because it explains why this project exists.

Python's standard library ships with the interpreter. You do not install it, you do not version it separately, and its numerical reach is deliberately thin: the heavy numerical work lives in third-party packages. C's stdlib.h is a header in a compiler toolchain, covering allocation, conversion and process control, with no statistical distributions at all.

stdlib-js/stdlib sits in neither position. It is a third-party package that you install from npm, but it is organised like a standard library, with namespaces, a CLI and a REPL. Where Python pushes numerics out to separate projects and C never had them, stdlib pulls them in and then lets you install them piece by piece. The decomposable architecture is the mechanism that makes that possible, and it is also why the installation section reads as a set of user stories rather than one command.

Maintenance, upgrades and the licence question

The repository is not archived, and its last push was on 2026-06-06. That is more than three months before the date of this article, so the honest description is a project that shipped two releases in June 2026 after a gap of roughly eighteen months since v0.3.2 in December 2024. The CHANGELOG.md file at the repository root is where the actual delta between those releases is recorded, and it is the first thing to read before upgrading.

Upgrade cost is structural rather than incidental. Because @stdlib/stdlib depends on separately versioned scoped packages, moving the root package forward pulls a set of sub-packages with it. The check-deps and check-licenses make targets exist for exactly this kind of audit, and package.json exposes them as npm scripts. Run them against your own tree rather than assuming the ranges resolve the way you expect.

On licensing: the Apache-2.0 text in the repository is the standard one, and NOTICE carries attribution requirements that travel with redistribution. The BSL-1.0 component in the package.json licence field is a permissive licence, but it is not the same licence, and the combination is expressed as AND. This is a description of what the files say, not legal advice; if your organisation has a licence allowlist, the AND expression is the detail to raise with whoever maintains it.

Editorial conclusion

Adopt stdlib if you need probability distributions, seedable PRNGs or special functions inside a JavaScript or TypeScript codebase and want TypeScript declarations and a CLI REPL alongside them. Do not adopt it if you only need a couple of helpers in a browser bundle: the README itself warns that installing the entire project leads to slower installation times, so use individual @stdlib packages instead. Before committing, verify that the packages you depend on carry the licence you expect, because package.json declares Apache-2.0 AND BSL-1.0 rather than a single identifier.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes