
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@mizzle-dev/orm
Advanced tools
A MongoDB ORM with exceptional developer experience, built for TypeScript.
any typeskeepFresh mode keeps embedded data synchronizednpm install @mizzle-dev/orm mongodb
# or
pnpm add @mizzle-dev/orm mongodb
# or
yarn add @mizzle-dev/orm mongodb
Requirements: Node.js 18+ and MongoDB 5.0+
import { mizzle, defineSchema, mongoCollection } from '@mizzle-dev/orm';
import { string, objectId, date } from '@mizzle-dev/orm';
import { lookup } from '@mizzle-dev/orm';
// Define collections
const users = mongoCollection('users', {
name: string(),
email: string(),
createdAt: date(),
});
const posts = mongoCollection(
'posts',
{
title: string(),
content: string(),
authorId: objectId(),
createdAt: date(),
},
{
relations: {
author: lookup(users, {
localField: 'authorId',
foreignField: '_id',
one: true,
}),
},
}
);
// Create schema and connect
const schema = defineSchema({ users, posts });
const db = await mizzle({
uri: 'mongodb://localhost:27017',
dbName: 'myapp',
schema,
});
// Create data
const user = await db().users.create({
name: 'Alice',
email: 'alice@example.com',
createdAt: new Date(),
});
const post = await db().posts.create({
title: 'Hello Mizzle!',
content: 'My first post',
authorId: user._id,
createdAt: new Date(),
});
// Query with perfect type inference
const posts = await db().posts.findMany(
{},
{
include: { author: true },
}
);
// TypeScript knows exact types!
posts[0].title; // string
posts[0].author?.name; // string | undefined
posts[0].author?.email; // string | undefined
Mizzle supports three relation strategies:
Denormalize data for lightning-fast reads with optional auto-updates:
import { embed } from '@mizzle-dev/orm';
const posts = mongoCollection('posts', {
title: string(),
authorId: objectId(),
}, {
relations: {
author: embed(users, {
forward: {
from: 'authorId',
fields: ['name', 'email'],
},
keepFresh: true, // Auto-update when user changes
}),
},
});
// Author data embedded automatically!
const post = await db().posts.create({
title: 'Hello World',
authorId: userId,
});
console.log(post.author.name); // Direct access, no join needed
Benefits:
keepFreshQuery-time joins using MongoDB $lookup:
import { lookup } from '@mizzle-dev/orm';
author: lookup(users, {
localField: 'authorId',
foreignField: '_id',
one: true,
})
Benefits:
Validate referential integrity:
import { reference } from '@mizzle-dev/orm';
author: reference(users, {
localField: 'authorId',
foreignField: '_id',
})
Pass context for auth and multi-tenancy:
// With context
const userPosts = await db({
user: { id: userId, role: 'admin' },
tenantId: 'acme-corp'
}).posts.findMany({});
// Without context
const allPosts = await db().posts.findMany({});
Built-in transaction support:
await db.tx({}, async (txDb) => {
const user = await txDb().users.create({ name: 'Bob' });
const post = await txDb().posts.create({
title: 'New Post',
authorId: user._id
});
// Committed atomically
});
Keep embedded data fresh automatically:
author: embed(users, {
forward: {
from: 'authorId',
fields: ['name', 'avatar']
},
keepFresh: true, // Updates automatically when user changes
})
Refresh embeds on-demand:
// Query-time refresh (read-only)
const posts = await db().posts.findMany(
{ status: 'published' },
{ refreshEmbeds: ['author'] }
);
// Batch refresh (persisted)
await db().posts.refreshEmbeds('author', {
filter: { updatedAt: { $lt: yesterday } },
batchSize: 100,
});
Unlimited depth with perfect type inference:
const posts = await db().posts.findMany({}, {
include: {
author: {
include: {
organization: true
}
},
comments: {
include: {
user: true
}
}
}
});
// All types perfectly inferred!
posts[0].author?.organization?.name // string | undefined
posts[0].comments[0]?.user?.email // string | undefined
| Scenario | Best Choice | Why |
|---|---|---|
| Blog post authors | EMBED + keepFresh | Fast reads, occasional updates |
| E-commerce orders | EMBED (no auto-update) | Historical snapshot |
| Real-time stock prices | LOOKUP | Always need latest data |
| User permissions | LOOKUP | Changes frequently |
| Tag clouds | EMBED + keepFresh | Fast display, rare changes |
Check out the examples directory for comprehensive demonstrations:
// Create
const user = await db().users.create({ name: 'Alice' });
const users = await db().users.createMany([...]);
// Read
const user = await db().users.findOne({ email: 'alice@example.com' });
const users = await db().users.findMany({ active: true });
const users = await db().users.findMany({}, { include: { posts: true } });
// Update
await db().users.updateOne({ _id: userId }, { name: 'Alice Updated' });
await db().users.updateMany({ active: false }, { deleted: true });
// Delete
await db().users.deleteOne({ _id: userId });
await db().users.deleteMany({ deleted: true });
// Aggregations
const result = await db().users.aggregate([...]);
// Raw access
const collection = db().users.collection; // Native MongoDB collection
db.schema // Collection definitions
db.client // Raw MongoClient
db.tx // Transaction helper
db.close() // Cleanup connection
Mizzle provides exceptional TypeScript support:
any types in your queriesRead Performance:
Recommendation: Use EMBED for read-heavy workloads, LOOKUP for write-heavy or when data changes frequently.
Contributions are welcome! Please check out our GitHub repository.
MIT © Mizzle Dev
Built with love for the MongoDB + TypeScript community
FAQs
Mizzle ORM - MongoDB ORM with exceptional DX
The npm package @mizzle-dev/orm receives a total of 2 weekly downloads. As such, @mizzle-dev/orm popularity was classified as not popular.
We found that @mizzle-dev/orm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.