
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
extract-mongo-schema
Advanced tools
Extract (and visualize) schema from Mongo database (including foreign keys)
Extract (and visualize) schema from Mongo database, including foreign keys. Output is simple json file or html with dagre/d3.js diagram (depending on command line options).
npm -g install extract-mongo-schema
Usage:
extract-mongo-schema -d connection_string -o schema.json -f json
-u, --authSource Database for authentication. Example: "admin".
-d, --database Database connection string. Example: "mongodb://localhost:3001/meteor".
-o, --output Output file
-f, --format Output file format. Can be "json", "html-diagram" or "xlsx". Default is "json".
-i, --inputJson Input JSON file, to be used instead of --database. NOTE: this will ignore the remainder of input params and use a previously generated JSON file to generate the diagram.
-c, --collection Comma separated list of collections to analyze. Example: "collection1,collection2".
-a, --array Comma separated list of types of arrays to analyze. Example: "Uint8Array,ArrayBuffer,Array".
-r, --raw Shows the exact list of types with frequency instead of the most frequent type only.
-l, --limit Number of records to parse to get the schema, default is 100.
-n, --dont-follow-fk Don't follow specified foreign key. Can be simply "fieldName" (all collections) or "collectionName:fieldName" (only for given collection).
-s, --include-system string Analyzes system collections as well.
Extract schema into json
extract-mongo-schema -d "mongodb://localhost:3001/meteor" -o schema.json
Extract schema into html
extract-mongo-schema -d "mongodb://localhost:3001/meteor" -o schema.html -f html-diagram
Extract schema into xlsx
extract-mongo-schema -d "mongodb://localhost:3001/meteor" -o schema.xlsx -f xlsx
Convert json to html
extract-mongo-schema -i schema.json -o schema.html -f html-diagram
Extract specific collections in raw format and analyze Array items
extract-mongo-schema -d "mongodb://localhost:3001/meteor" -o schema.json -c "collection1,collection2,collection3" -a "Array" -r
Open html in your browser and you'll see rendered ER diagram.
Ignore some foreign keys
Use -n switch to prevent detecting and drawing links for specified fields. You can specify simply fieldName (that applies to all collections) or collectionName:fieldName (foreign key is ignored only in given collection).
Example:
extract-mongo-schema -d "mongodb://localhost:3001/meteor" -o schema.html -f html-diagram -n createdBy -n users:modifiedBy
(in this example: any foreign key named "createdBy" will be ignored. Also "modifiedBy" but only in users collection)

schema.json
{
"customers": {
"_id": {
"primaryKey": true,
"type": "string",
"required": true
},
"name": {
"type": "string",
"required": true
},
"phone": {
"type": "string",
"required": true
},
"email": {
"type": "string",
"required": true
},
"note": {
"type": "string",
"required": true
},
"createdAt": {
"type": "Date",
"required": true
},
"createdBy": {
"key": true,
"type": "string",
"required": true
},
"modifiedAt": {
"type": "Date",
"required": true
},
"modifiedBy": {
"key": true,
"type": "string",
"required": true
},
"ownerId": {
"key": true,
"type": "string",
"required": true
}
},
"invoices": {
"_id": {
"primaryKey": true,
"type": "string",
"required": true
},
"invoiceNumber": {
"type": "string",
"required": true
},
"date": {
"type": "Date",
"required": true
},
"customerId": {
"foreignKey": true,
"references": "customers",
"key": true,
"type": "string",
"required": true
},
"createdAt": {
"type": "Date",
"required": true
},
"createdBy": {
"key": true,
"type": "string",
"required": true
},
"modifiedAt": {
"type": "Date",
"required": true
},
"modifiedBy": {
"key": true,
"type": "string",
"required": true
},
"ownerId": {
"key": true,
"type": "string",
"required": true
},
"totalAmount": {
"type": "number",
"required": true
}
},
"users": {
"_id": {
"primaryKey": true,
"type": "string",
"required": true
},
"createdAt": {
"type": "Date",
"required": true
},
"services": {
"type": "Object",
"structure": {
"password": {
"type": "Object",
"structure": {
"bcrypt": {
"type": "string",
"required": true
}
},
"required": true
},
"resume": {
"type": "Object",
"structure": {
"loginTokens": {
"type": "Array",
"required": true
}
},
"required": true
}
},
"required": true
},
"emails": {
"type": "Array",
"required": true
},
"roles": {
"type": "Array",
"required": true
},
"profile": {
"type": "Object",
"structure": {
"name": {
"type": "string",
"required": true
},
"email": {
"type": "string",
"required": true
},
"facebook": {
"type": "string",
"required": true
},
"google": {
"type": "string",
"required": true
},
"twitter": {
"type": "string",
"required": true
},
"website": {
"type": "string",
"required": true
}
},
"required": true
}
},
"meteor_accounts_loginServiceConfiguration": {},
"invoice_items": {
"_id": {
"primaryKey": true,
"type": "string",
"required": true
},
"description": {
"type": "string",
"required": true
},
"quantity": {
"type": "number",
"required": true
},
"price": {
"type": "number",
"required": true
},
"invoiceId": {
"key": true,
"foreignKey": true,
"references": "invoices",
"type": "string",
"required": true
},
"createdAt": {
"type": "Date",
"required": true
},
"createdBy": {
"key": true,
"foreignKey": true,
"references": "users",
"type": "string",
"required": true
},
"modifiedAt": {
"type": "Date",
"required": true
},
"modifiedBy": {
"key": true,
"foreignKey": true,
"references": "users",
"type": "string",
"required": true
},
"ownerId": {
"key": true,
"foreignKey": true,
"references": "users",
"type": "string",
"required": true
},
"amount": {
"type": "number",
"required": true
}
}
}
That's all folks. Enjoy! :)
FAQs
Extract (and visualize) schema from Mongo database (including foreign keys)
We found that extract-mongo-schema demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.