
Security News
AI Agent Lands PRs in Major OSS Projects, Targets Maintainers via Cold Outreach
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.
[!WARNING] The original DuckDB <> Node.js bindings in this package are deprecated in favor of the new and shiny
@duckdb/node-apipackage. Currently, the plan is to release this packageduckdb-nodefor the last time for the DuckDB 1.4.x (~Fall 2025) series but not for the DuckDB 1.5.x series (~Early 2026) any more. Please contact DuckDB Labs if you absolutely require updates after that.
This package provides a Node.js API for DuckDB, the "SQLite for Analytics". The API for this client is somewhat compliant to the SQLite Node.js client for easier transition (and transition you must eventually).
Load the package and create a database object:
var duckdb = require('duckdb');
var db = new duckdb.Database(':memory:'); // or a file name for a persistent DB
Then you can run a query:
db.all('SELECT 42 AS fortytwo', function(err, res) {
if (err) {
console.warn(err);
}
console.log(res[0].fortytwo)
});
Other available methods are each, where the callback is invoked for each row, run to execute a single statement without results and exec, which can execute several SQL commands at once but also does not return results. All those commands can work with prepared statements, taking the values for the parameters as additional arguments. For example like so:
db.all('SELECT ?::INTEGER AS fortytwo, ?::STRING as hello', 42, 'Hello, World', function(err, res) {
if (err) {
console.warn(err);
}
console.log(res[0].fortytwo)
console.log(res[0].hello)
});
However, these are all shorthands for something much more elegant. A database can have multiple Connections, those are created using db.connect().
var con = db.connect();
You can create multiple connections, each with their own transaction context.
Connection objects also contain shorthands to directly call run(), all() and each() with parameters and callbacks, respectively, for example:
con.all('SELECT 42 AS fortytwo', function(err, res) {
if (err) {
console.warn(err);
}
console.log(res[0].fortytwo)
});
From connections, you can create prepared statements (and only that) using con.prepare():
var stmt = con.prepare('select ?::INTEGER as fortytwo');
To execute this statement, you can call for example all() on the stmt object:
stmt.all(42, function(err, res) {
if (err) {
console.warn(err);
}
console.log(res[0].fortytwo)
});
You can also execute the prepared statement multiple times. This is for example useful to fill a table with data:
con.run('CREATE TABLE a (i INTEGER)');
var stmt = con.prepare('INSERT INTO a VALUES (?)');
for (var i = 0; i < 10; i++) {
stmt.run(i);
}
stmt.finalize();
con.all('SELECT * FROM a', function(err, res) {
if (err) {
console.warn(err);
}
console.log(res)
});
prepare() can also take a callback which gets the prepared statement as an argument:
var stmt = con.prepare('select ?::INTEGER as fortytwo', function(err, stmt) {
stmt.all(42, function(err, res) {
if (err) {
console.warn(err);
}
console.log(res[0].fortytwo)
});
});
We actively support only LTS and In-Support Node versions, as per July 2023, they are: Node 18, Node 20 and Node 21. For OSX and Linux targets, also Node 22 is available. Release schedule for Node.js can be checked here: https://github.com/nodejs/release#release-schedule.
We currently bundle and test DuckDB also for Node 12, 14, 16, 17 and 19. We plan of going so going forward as long as the tooling supports it. As per July 2023, Node 15 has been removed from the supported versions.
To install all the dev dependencies of the project, run npm install (this uses package.json)
You might want to add the --ignore-scripts option if you don't care about building the package for now and just want to install the dependencies.
Tests are located in test and can be run with npm test
To run a single test, you can use npm test -- --grep "name of test as given in describe"
To build the NodeJS package from source, when on Windows, requires the following extra steps:
OPENSSL_ROOT_DIR to the root directory of an OpenSSL installationSTATIC_OPENSSL=1 option when executing make, or set -DOPENSSL_USE_STATIC_LIBS=1 manually when calling cmakeThe sqlite3 package provides a self-contained, serverless, and zero-configuration SQL database engine. It is similar to DuckDB in that it can be embedded in applications and used for local data storage. However, DuckDB is optimized for analytical queries and large datasets, whereas SQLite is more suited for smaller, transactional workloads.
better-sqlite3 is an alternative to the sqlite3 package that offers a simpler API and better performance for synchronous operations. Like DuckDB, it is an embedded database, but it is primarily designed for transactional workloads rather than analytical processing.
AlaSQL is a JavaScript SQL database library that runs in the browser and Node.js. It is designed for in-memory data processing and can handle complex queries. While it offers similar in-memory capabilities as DuckDB, it is not as optimized for large-scale analytical queries.
FAQs
DuckDB node.js API
The npm package duckdb receives a total of 198,765 weekly downloads. As such, duckdb popularity was classified as popular.
We found that duckdb demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.

Research
/Security News
Chrome extension CL Suite by @CLMasters neutralizes 2FA for Facebook and Meta Business accounts while exfiltrating Business Manager contact and analytics data.

Security News
After Matplotlib rejected an AI-written PR, the agent fired back with a blog post, igniting debate over AI contributions and maintainer burden.