
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@allnulled/sqlite-polyfill
Advanced tools
SQLite Polyfill. Cross-environment: same API for Node.js and browser.
Use sqlite3 on Node.js and sql.js on browser, through the same API.
npm install -s @allnulled/sqlite-polyfill
First, if you have doubts, take a look to the test/test.js file, which works on both environments, but see also test/index.html for the browser implementation. You'll see this explanation in action.
So, despite the API is the same for both environments, there are some differences you must take care of on the load step.
In Node.js, with this conditional you can patch on browser, and set to global scope on node.js:
if(typeof global !== "undefined") {
require(__dirname + "/../sqlite-polyfill.js");
}
In browser, though, you have to load the polyfill as script tag, and the sql.js with its wasm file like so:
<script src="sqljs-wasm/sql-wasm.js"></script>
<script src="sqlite-polyfill/sqlite-polyfill.js"></script>
Then, you will have to copy the following files and integrate them in your HTML, in this same order:
test/sqljs-wasm/sql-wasm.jstest/sqljs-wasm/sql-wasm.wasm (not included by script, but by API init method)test/sqlite-polyfill/sqlite-polyfill.jsThe last conflictive point is the init function, which takes parameters for both environments.
const db = new SQLitePolyfill();
// @ATTENTION!
// - In browser, 1st parameter is the key in localStorage
// - In node.js, 2nd parameter is ignored. See this path is relative to where you put the `test/sqljs-wasm/sql-wasm.wasm`
await db.init('example.db', "sqljs-wasm/$filename");
await db.run("CREATE TABLE IF NOT EXISTS test (id INTEGER PRIMARY KEY, name TEXT)");
await db.run("INSERT INTO test (name) VALUES (?)", ["Alice"]);
const rows = await db.all("SELECT * FROM test");
console.log(rows);
await db.close();
This library can be useful to create (1) cross-environment (2) database-oriented scripts (3) based on SQL/SQLite.
The polyfill comes with some extra advantages that the libraries may not come. For example:
This is an example of how to use it in node.js and browser with the same script:
(async () => {
if(typeof global !== "undefined") {
require(__dirname + "/../sqlite-polyfill.js");
}
const db = new SQLitePolyfill();
// @ATTENTION!
// - In browser, 1st parameter is the key in localStorage
// - In node.js, 2nd parameter is ignored. See this path is relative to where you put the `test/sqljs-wasm/sql-wasm.wasm`
await db.init('example.db', "sqljs-wasm/$filename");
await db.run("CREATE TABLE IF NOT EXISTS test (id INTEGER PRIMARY KEY, name TEXT)");
await db.run("INSERT INTO test (name) VALUES (?)", ["Alice"]);
const rows = await db.all("SELECT * FROM test");
console.log(rows);
await db.close();
})();
Yes, the same than before. I think it is enough clear. The test is imported from node and from browser, and works for both.
Yes, sqlite. With the WASM bindings and persistence for browser.
FAQs
SQLite Polyfill. Cross-environment: same API for Node.js and browser.
We found that @allnulled/sqlite-polyfill demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.