
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
@sqlite.org/sqlite-wasm
Advanced tools
SQLite Wasm conveniently wrapped as an ES Module.
[!Warning]
This project wraps the code of SQLite Wasm with no changes, apart from added TypeScript types. Please do not file issues or feature requests regarding the underlying SQLite Wasm code here. Instead, please follow the SQLite bug filing instructions. Filing TypeScript type related issues and feature requests is fine.
[!Warning]
Node.js is currently only supported for in-memory databases without persistence.
npm install @sqlite.org/sqlite-wasm
There are three ways to use SQLite Wasm:
Only the worker versions allow you to use the origin private file system (OPFS) storage back-end.
[!Warning]
For this to work, you need to set the following headers on your server:
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
import {
sqlite3Worker1Promiser,
type Worker1Promiser,
} from '@sqlite.org/sqlite-wasm';
const initializeSQLite = async () => {
try {
const promiser = await sqlite3Worker1Promiser.v2();
const configResponse = await promiser('config-get', {});
console.log(
'Running SQLite3 version',
configResponse.result.version.libVersion,
);
const openResponse = await promiser('open', {
filename: 'file:mydb-v2.sqlite3?vfs=opfs',
});
console.log(
'OPFS is available, created persisted database at',
openResponse.result.filename.replace(/^file:(.*?)\?vfs=opfs$/, '$1'),
);
} catch (err: any) {
if (!(err instanceof Error)) {
err = new Error(err.result.message || 'Unknown error');
}
console.error(err.name, err.message);
}
};
await initializeSQLite();
The promiser object above implements the
Worker1 API.
[!Warning]
For this to work, you need to set the following headers on your server:
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
// In `main.js`.
const worker = new Worker('worker.js', { type: 'module' });
// In `worker.js`.
import sqlite3InitModule from '@sqlite.org/sqlite-wasm';
const log = console.log;
const error = console.error;
const start = (sqlite3) => {
log('Running SQLite3 version', sqlite3.version.libVersion);
const db =
'opfs' in sqlite3
? new sqlite3.oo1.OpfsDb('/mydb.sqlite3')
: new sqlite3.oo1.DB('/mydb.sqlite3', 'ct');
log(
'opfs' in sqlite3
? `OPFS is available, created persisted database at ${db.filename}`
: `OPFS is not available, created transient database ${db.filename}`,
);
// Your SQLite code here.
};
const initializeSQLite = async () => {
try {
log('Loading and initializing SQLite3 module...');
const sqlite3 = await sqlite3InitModule();
log('Done initializing. Running demo...');
start(sqlite3);
} catch (err) {
error('Initialization error:', err.name, err.message);
}
};
initializeSQLite();
The db object above implements the
Object Oriented API #1.
import sqlite3InitModule from '@sqlite.org/sqlite-wasm';
const log = console.log;
const error = console.error;
const start = (sqlite3) => {
log('Running SQLite3 version', sqlite3.version.libVersion);
const db = new sqlite3.oo1.DB('/mydb.sqlite3', 'ct');
// Your SQLite code here.
};
const initializeSQLite = async () => {
try {
log('Loading and initializing SQLite3 module...');
const sqlite3 = await sqlite3InitModule();
log('Done initializing. Running demo...');
start(sqlite3);
} catch (err) {
error('Initialization error:', err.name, err.message);
}
};
initializeSQLite();
The db object above implements the
Object Oriented API #1.
If you are using vite, you need to add the following
config option in vite.config.js:
import { defineConfig } from 'vite';
export default defineConfig({
server: {
headers: {
'Cross-Origin-Opener-Policy': 'same-origin',
'Cross-Origin-Embedder-Policy': 'require-corp',
},
},
optimizeDeps: {
exclude: ['@sqlite.org/sqlite-wasm'],
},
});
Check out a sample project that shows this in action.
See the demo folder for examples of how to use this in the main thread and in a worker. (Note that the worker variant requires special HTTP headers, so it can't be hosted on GitHub Pages.) An example that shows how to use this with vite is available on StackBlitz.
See the list of npm dependents for this package.
(These steps can only be executed by maintainers.)
Manually trigger the
GitHub Actions workflow. By
default, it uses the latest SQLite tag. This pull request will contain the
latest sqlite3.wasm and related bindings.
Once the above pull request is validated and merged, update the version
number in package.json, reflecting the current
SQLite version number and add a build
identifier suffix like -build1. The complete version number should read
something like 3.41.2-build1.
Build the Docker image:
docker build -t sqlite-wasm-builder:env .
Run the build:
Unix (Linux/macOS):
docker run --rm \
-e SQLITE_REF="master" \
-v "$(pwd)/out":/out \
-v "$(pwd)/src/bin":/src/bin \
sqlite-wasm-builder:env build
Windows (PowerShell):
docker run --rm `
-e SQLITE_REF="master" `
-v "${PWD}/out:/out" `
-v "${PWD}/src/bin:/src/bin" `
sqlite-wasm-builder:env build
Windows (Command Prompt):
docker run --rm ^
-e SQLITE_REF="master" ^
-v "%cd%/out:/out" ^
-v "%cd%/src/bin:/src/bin" ^
sqlite-wasm-builder:env build
The test suite consists of Node.js tests and browser-based tests (using Vitest Browser Mode). Tests aim to sanity-check the exported scripts. We test for correct exports and very basic functionality.
Install dependencies:
npm install
Install Playwright browsers (required for browser tests):
npx playwright install chromium --with-deps --no-shell
Run all tests:
npm test
Apache 2.0.
This project is based on SQLite Wasm, which it
conveniently wraps as an ES Module and publishes to npm as
@sqlite.org/sqlite-wasm.
FAQs
SQLite Wasm conveniently wrapped as an ES Module.
The npm package @sqlite.org/sqlite-wasm receives a total of 225,961 weekly downloads. As such, @sqlite.org/sqlite-wasm popularity was classified as popular.
We found that @sqlite.org/sqlite-wasm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.