
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@ttoss/postgresdb-cli
Advanced tools
A library to handle PostgreSQL database actions through the command line
CLI for managing PostgreSQL databases with Sequelize.
pnpm add -D @ttoss/postgresdb-cli
Define your db object using @ttoss/postgresdb. The CLI imports this object to load models and interact with the database.
Set connection environment variables in .env files:
DATABASE_NAME=postgres
DATABASE_USER=postgres
DATABASE_PASSWORD=mysecretpassword
DATABASE_HOST=localhost
DATABASE_PORT=5432
Environment-specific configuration: Use --environment or -e flag to load .env.<environment> files (e.g., .env.Production, .env.Staging) instead of the default .env. This prevents accidental use of production credentials.
syncSynchronize database schema with models:
pnpm dlx @ttoss/postgresdb-cli sync -e Development
⚠️ Required: The --environment or -e flag is mandatory to explicitly specify which environment credentials to use. This prevents accidental operations on the wrong database.
Using environment-specific credentials:
pnpm dlx @ttoss/postgresdb-cli sync --alter -e Production
This loads variables from .env.Production.
Behavior:
--alter: Creates new tables only (preserves existing schema)--alter: Creates new tables, adds/removes columns to match models, creates new indexes (preserves tables and indexes not in models). Requires confirmation before executing.⚠️ Caution: The --alter flag modifies your database schema. Removing columns will delete data permanently. The CLI will prompt for confirmation before proceeding. Always backup your database before using --alter in production. For production environments, use proper migration tools instead of sync.
Testing before using --alter: Always ensure your models have comprehensive tests before running sync --alter. Tests validate that all model properties are correctly defined and prevent accidental column removal. If a column is missing from your model definition, --alter will drop it from the database. See the @ttoss/postgresdb testing guide for details on setting up model tests.
Add to package.json for convenience:
{
"scripts": {
"sync": "ttoss-postgresdb sync"
}
}
Then run pnpm sync -e Development or pnpm sync --alter -e Production from the command line.
Options:
--db-path, -d: Path to db object file (default: ./src/db.js)--alter: Alter schema to match models (default: false)--environment, -e: (Required) Specify environment to load .env.<environment> fileerdGenerate an Entity-Relationship Diagram from your models:
pnpm dlx @ttoss/postgresdb-cli erd
Note: This command generates diagrams from model definitions only - database credentials are not required unless you need to validate against an actual database.
Add to package.json for convenience:
{
"scripts": {
"erd": "ttoss-postgresdb erd"
}
}
Options:
--db-path, -d: Path to db object file (default: ./src/db.js)--engine: Layout engine - circo, dot, fdp, neato, osage, twopi (default: circo)FAQs
A library to handle PostgreSQL database actions through the command line
The npm package @ttoss/postgresdb-cli receives a total of 114 weekly downloads. As such, @ttoss/postgresdb-cli popularity was classified as not popular.
We found that @ttoss/postgresdb-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.