Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The purpose of this library is to consolidate the behaviours of various database drivers into a minimal and consistent API. See the design document for a thorough overview of the planned API.
Things it does:
driver://user:pass@host/database
pool.query("SELECT 1", function (err, results) { ... })
Things it will do soon:
Things it might do:
Things it will never do:
.first
or .fetchAll
Creating a connection:
var anyDB = require('any-db')
, conn = anyDB.createConnection('postgres://user:pass@localhost/dbname')
Simple queries with callbacks are exactly what you'd expect:
conn.query("SELECT * FROM my_table LIMIT 10", function (err, rows) {
for (var i in rows) {
console.log("Row " + i + ": %j", row)
}
})
If no callback is provided, the query object returned will emit the following events:
var query = conn.query('SELECT * FROM my_table')
query.on('fields', function (fields) { /* fields is an array of field names */ })
query.on('row', function (row) { /* row is plain object */ })
query.on('end', function () { /* always emitted when results are exhausted */ })
query.on('error', function () { /* emitted on errors :P */ })
You can also create or get an existing connection pool with anyDB.getPool
. It
takes the following options:
var pool = anyDB.getPool('postgres://user:pass@localhost/dbname', {
min: 5, // Minimum connections
max: 10, // Maximum connections
onConnect: function (conn, ready) {
/*
perform any necessary connection setup before calling ready(err, conn)
*/
},
reset: function (conn, ready) {
/*
perform any necessary reset of connection state before the connection can
be re-used. The default callback does conn.query("ROLLBACK", ready)
*/
}
})
A connection pool has the following methods available:
// Exactly like conn.query above, but the underlying connection will be
// auto-released back into the pool when the query completes.
pool.query(...)
Transactions can be started with begin
, in this example we stream all users
and then apply updates based on the results from an external service:
var tx = pool.begin()
tx.on('error', function (err) {
// Called for any query errors without an associated callback
tx.rollback()
finished(err)
})
tx.query('SELECT id FROM users').on('row', function (user) {
if (tx.state() == 'rolled back') return
externalService.method(user.id, function (err, result) {
if (err) return tx.handleError(err)
// Errors from these queries will propagate up to the transaction object
if (result.flag) {
tx.query('UPDATE users SET flag = 1 WHERE id = ?', [user.id])
} else if (result.deleteme) {
tx.query('DELETE FROM users WHERE id = ?', [user.id])
}
})
}).on('end', function () {
tx.commit(finished)
})
function finished (err) {
if (err) console.error(err)
else console.log('All done!')
}
MIT
FAQs
Database-agnostic connection pooling, querying, and result sets
We found that any-db demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.