
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@shipfox/node-pg
Advanced tools
Thin wrapper around `pg` that centralizes connection config via environment variables and exposes a simple lifecycle API for shared pool usage.
Thin wrapper around pg that centralizes connection config via environment variables and exposes a simple lifecycle API for shared pool usage.
It should be used with other packages from Shipfox.
pg.Pool configured from environment variables and optional overrides.SELECT 1 to report readiness.pg for direct usage.Environment variables (with defaults):
POSTGRES_HOST (default: localhost)POSTGRES_PORT (default: 5432)POSTGRES_USERNAME (default: shipfox)POSTGRES_PASSWORD (default: password)POSTGRES_DATABASE (default: api)pnpm add @shipfox/node-pg
# or
yarn add @shipfox/node-pg
# or
npm install @shipfox/node-pg
import {
createPostgresClient,
pgClient,
closePostgresClient,
isPostgresHealthy,
type Pool,
} from "@shipfox/node-pg";
// 1) Create the pool at startup (optionally pass pg.PoolConfig overrides)
const pool: Pool = createPostgresClient({
// connectionTimeoutMillis: 5000,
// max: 10,
});
// 2) Use the pool elsewhere without passing it around
async function getServerTime() {
const client = await pgClient().connect();
try {
const res = await client.query("SELECT NOW() AS now");
return res.rows[0]?.now;
} finally {
client.release();
}
}
// 3) Health check
async function ready() {
return await isPostgresHealthy();
}
// 4) Clean shutdown
async function shutdown() {
await closePostgresClient();
}
Configure via environment variables before starting your app:
export POSTGRES_HOST="127.0.0.1"
export POSTGRES_PORT="5432"
export POSTGRES_USERNAME="service_user"
export POSTGRES_PASSWORD="supersecret"
export POSTGRES_DATABASE="appdb"
FAQs
Thin wrapper around `pg` that centralizes connection config via environment variables and exposes a simple lifecycle API for shared pool usage.
We found that @shipfox/node-pg demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.