
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
graphql-postgres-subscriptions
Advanced tools
[](https://travis-ci.org/GraphQLCollege/graphql-postgres-subscriptions)
A graphql subscriptions implementation using postgres and apollo's graphql-subscriptions.
This package implements the PubSubEngine Interface from the graphql-subscriptions package and also the new AsyncIterator interface. It allows you to connect your subscriptions manger to a postgres based Pub Sub mechanism to support multiple subscription manager instances.
yarn add graphql-postgres-subscriptions or npm install graphql-postgres-subscriptions --save
Example app: https://github.com/GraphQLCollege/apollo-subscriptions-example
First of all, follow the instructions in graphql-subscriptions to add subscriptions to your app.
Afterwards replace PubSub with PostgresPubSub:
// Before
import { PubSub } from "graphql-subscriptions";
export const pubsub = new PubSub();
// After
import { PostgresPubSub } from "graphql-postgres-subscriptions";
export const pubsub = new PostgresPubSub();
This library uses node-postgres to connect to PostgreSQL. If you want to customize connection options, please refer to their connection docs.
You have three options:
If you don's send any argument to new PostgresPubSub(), we'll create a postgres client with no arguments.
You can also pass node-postgres connection options to PostgresPubSub.
You can instantiate your own client and pass it to PostgresPubSub. Like this:
import { PostgresPubSub } from "graphql-postgres-subscriptions";
import { Client } from "pg";
const client = new Client();
await client.connect();
const pubsub = new PostgresPubSub({ client });
Important: Don't pass clients from pg's Pool to PostgresPubSub. As node-postgres creator states in this StackOverflow answer, the client needs to be around and not shared so pg can properly handle NOTIFY messages (which this library uses under the hood)
The second argument to new PostgresPubSub() is the commonMessageHandler. The common message handler gets called with the received message from PostgreSQL.
You can transform the message before it is passed to the individual filter/resolver methods of the subscribers.
This way it is for example possible to inject one instance of a DataLoader which can be used in all filter/resolver methods.
const getDataLoader = () => new DataLoader(...)
const commonMessageHandler = ({attributes: {id}, data}) => ({id, dataLoader: getDataLoader()})
const pubsub = new PostgresPubSub({ client, commonMessageHandler });
export const resolvers = {
Subscription: {
somethingChanged: {
resolve: ({ id, dataLoader }) => dataLoader.load(id)
}
}
};
PostgresPubSub instances emit a special event called "error". This event's payload is an instance of Javascript's Error. You can get the error's text using error.message.
const ps = new PostgresPubSub({ client });
ps.subscribe("error", err => {
console.log(err.message); // -> "payload string too long"
}).then(() => ps.publish("a", "a".repeat(9000)));
For example you can log all error messages (including stack traces and friends) using something like this:
ps.subscribe("error", console.error);
This project has an integration test suite that uses jest to make sure everything works correctly.
We use Docker to spin up a PostgreSQL instance before running the tests. To run them, type the following commands:
docker-compose builddocker-compose run testFAQs
[](https://travis-ci.org/GraphQLCollege/graphql-postgres-subscriptions)
The npm package graphql-postgres-subscriptions receives a total of 381 weekly downloads. As such, graphql-postgres-subscriptions popularity was classified as not popular.
We found that graphql-postgres-subscriptions demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.