
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
This Node.js package provides a CLI client to connect and query AWS Aurora Database Clusters using the Data API. It mimics the mysql and psql CLI clients.
First, create an Aurora Serverless Database (here's a blog post with an example).
Next install this package:
$ npm install --global adasql
Now run the command:
$ adasql -d testdb
Using AWS Credentials: From local environment
Using AWS Region: From local environment
AWS Account: 012345678901
AWS Region: us-west-2
AWS User: assumed-role/alice@example.com/cli
AWS Account Alias: (none)
Found only one Aurora Data API-enabled Database Cluster: mystack-mydb-s98d7f8d7f
Found only one secret in AWS Secrets Manager: /mystack/mydb/user-secret
Connecting with the following configuration:
RDS Aurora Cluster ID: mystack-mydb-s98d7f8d7f
Secrets Manager Secret Name: /mystack/mydb/user-secret
Database: testdb
> SELECT * FROM feature_flags;
Records:
-
id: 1
feature_name: myAwesomeNewFeature
Record Count: 1
adasql will show you information up top to help you ensure you're connecting to the right DB. It will then look for AWS Aurora Database Clusters with the Data API enabled. If it finds only one database cluster it will use it, otherwise it will prompt you for the database to connect to. It will then look for AWS Secrets Manager Secrets to use for authentication when connecting. Again, if it finds only one secret it will use it, otherwise it will prompt you for the secret to use.
Transactions are supported, though note the Data API doesn't support save points or nested transactions.
SQL statements are executed sequentially, and multiple statements can be executed when separated with the ';' delimiter. For example, the following query when executed will insert a new record and then return the same record as the first statement executes to completion before the second statement is executed:
INSERT INTO people (id, name, age) VALUES (1, 'Alice', 39); SELECT * from mytable WHERE id = 1;
If you find yourself in the middle of a multi-line statement and wish to cancel it, enter .clear
. This will reset the state of the REPL, though it will not affect a transaction if it is in progress.
Maybe! But for most use cases adasql will not work. The Aurora Data API has three issues that make migrations and restoring backups difficult:
SET FOREIGN_KEY_CHECKS=0
to disable foreign key checks when inserting records using the same connection. Multiple statements that need to be executed on the same connection with these connection-specific variables will likely fail part-way through execution.Your use case may not hit these limitations, in which case have at it! But many use cases will, especially the first and second limitations when attempting to restore a mysqldump backup. You may find you can work around the limitations by:
--extended-insert=FALSE
argument to insert every record using a separate statement to keep statements under 64 KB in sizeFAQs
CLI SQL client for AWS Aurora Data API Databases
The npm package adasql receives a total of 0 weekly downloads. As such, adasql popularity was classified as not popular.
We found that adasql demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.