
Research
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
CLI to help you hit the ground running without any sign-up. Instantiate a database with a single-command!
Note: This package was previously named
neondb. The old package is now deprecated. If you're upgrading fromneondb, simply replace it withget-dbin your commands and imports.
npx get-db
npx get-db [options]
Options:
-y, --yes Use defaults, skip prompts-e, --env Path to .env file (default: ./.env)-k, --key Env key for connection string (default: DATABASE_URL)-p, --prefix Prefix for public env vars (default: PUBLIC_)-s, --seed Path to SQL file to execute after database creation-h, --help Show helpImport the SDK:
import { instantNeon } from "get-db/sdk";
Create a claimable Neon Postgres database and save credentials to your .env:
await instantNeon({
dotEnvFile: ".env",
dotEnvKey: "DATABASE_URL",
envPrefix: "PUBLIC_",
// This below is to help us understand where usage comes from.
// If you're publishing a library, we'd love that you re-expose a
// referrer parameter in your lib and set this to `npm:your-lib-package-name|${referrer}`
// So we can understand the chain better and give you all the credit you deserve!
referrer: "npm:your-cli-package-name",
});
| Option | Default | Description | Validation |
|---|---|---|---|
| dotEnvFile | ".env" | Path to env file | letters and . |
| dotEnvKey | "DATABASE_URL" | Environment variable name | `SCREAMING_SNAKE_CASE |
| envPrefix | "PUBLIC_" | Prefix for public environment vars | - |
| referrer | "unknown" | Referrer identifier | - |
Note: The Vite plugin uses
VITE_as the defaultenvPrefixto match Vite's convention for client-side environment variables.
Returns:
| Property | Description |
|---|---|
databaseUrl | connection string |
poolerUrl | pooled connection string |
claimUrl | claim link |
claimExpiresAt | expiration date |
When you run get-db, the following environment variables are written to your .env file:
| Variable | Description |
|---|---|
DATABASE_URL | The pooler connection string (default connection) |
DATABASE_URL_DIRECT | The direct connection string |
{envPrefix}INSTAGRES_CLAIM_URL | Claim URL (valid for 7 days) to take ownership of the DB |
Note: The pooler connection is now the default for
DATABASE_URL(as of the latest version). The pooler provides connection pooling and is recommended for most use cases, especially serverless environments.
// Params for instantNeon
interface InstantNeonParams {
dotEnvFile?: string;
dotEnvKey?: string;
envPrefix?: string;
referrer?: string;
}
See documentation on Neon for more.
This package was templated with create-typescript-app using the Bingo engine.
FAQs
[DEPRECATED] This package has been renamed to 'neon-new'. Please use 'neon-new' instead.
The npm package get-db receives a total of 1,246 weekly downloads. As such, get-db popularity was classified as popular.
We found that get-db demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.