
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Lightweight JSON-based database for JavaScript-based apps with real-time sync, REST API, and zero configuration.
Collection-based JSON database for NodeJS
Local database + REST API + Real-time Sync
✅ ZERO configuration
✅ Out of the box Firebase/MongoDB Alternative!
✅ Recommended for Small to Medium Scale Apps
✅ Lightweight
✅ Local-first
✅ RESTful API built-in
✅ Real-time sync
✅ Works with React, Vue, Angular, Mobile Apps, etc
❌ Firebase is expensive, vendor lock-in, and has complex pricing
❌ MongoDB is heavy, and requires separate server setup
❌ Redis is in-memory only, and has no persistence by default
find(), where(), filteringstartServer() and it's live!GET, POST, PUT, DELETE endpointsnpm install jslitedb express socket.io socket.io-client cors
const JSLiteDB = require('jslitedb');
const db = new JSLiteDB();
// Initialize database
// (optional - done automatically on first operation)
await db.init();
// Basic operations
const users = db.collection('users');
users.insert('user:1', { name: 'John', age: 25 }); // With defined ID
users.insert({ name: 'John', age: 25 }); // With generated ID
console.log(users.findOne('user:1'));
// Outputs { name: 'John', age: 25 }
// Query system
const topUsers = users.find()
.sort('score', 'desc')
.limit(2)
.values();
// Clean shutdown
// (optional but recommended)
await db.close();
const db = new JSLiteDB({
folderPath: './data',
autoSaveInterval: 5000,
enableIndexing: true
});
await db.init();
Note:
Database initialization is automatic when you perform the first operation, but callinginit()explicitly can be useful for:
- Error handling during startup
- Ensuring database is ready before server starts
- Testing scenarios where you need predictable initialization timing
await db.close();
The close() method will:
Best practices:
close() before your application exits// Example: Graceful shutdown on SIGINT
process.on('SIGINT', async () => {
console.log('Shutting down gracefully...');
await db.close();
process.exit(0);
});
const JSLiteDB = require('jslitedb');
const db = new JSLiteDB({
enableServer: true, // Enable RESTful API
serverPort: 3000, // Defaults the server port
enableRealtime: true, // Enable WebSocket
apiKey: '[YOUR-SECRET-KEY]' // Optional authentication
});
// Or start manually:
// await db.startServer(3000);
// 🚀 Server is now running on http://localhost:3000
GET /api/health
Create Document
POST /api/:collection
Content-Type: application/json
# For auto-generated ID
{ "name": "John", "age": 25 }
# For custom ID
{ "id": "user123", "name": "John", "age": 25 }
Get Document by ID
GET /api/:collection/:id
Update Document
PUT /api/:collection/:id
Content-Type: application/json
{ "name": "John", "age": 26 }
Delete Document
DELETE /api/:collection/:id
Get All Documents (with pagination)
GET /api/:collection
GET /api/:collection?limit=10
GET /api/:collection?skip=20&limit=10
Get Document Count
GET /api/:collection/count
Get Database Statistics
GET /api/stats
Backup Database
POST /api/backup
Content-Type: application/json
{ "path": "/path/to/backup.json" }
Restore Database
POST /api/restore
Content-Type: application/json
{ "path": "/path/to/backup.json" }
Create a user:
curl -X POST http://localhost:3000/api/users \
-H "Content-Type: application/json" \
-d '{ "name": "John Doe", "email": "john@example.com", "age": 25 }'
Get a user:
curl http://localhost:3000/api/users/user123
Update a user:
curl -X PUT http://localhost:3000/api/users/user123 \
-H "Content-Type: application/json" \
-d '{ "name": "John Updated", "age": 26 }'
Get all users with pagination:
curl "http://localhost:3000/api/users?limit=10&skip=0"
Get user count:
curl http://localhost:3000/api/users/count
// Server side
const db = new JSLiteDB({
apiKey: '[YOUR-SECRET-KEY-123]'
});
Client side - Multiple authentication methods supported:
// Method 1: X-API-Key header
fetch('http://localhost:3000/api/users', {
headers: {
'X-API-Key': '[YOUR-SECRET-KEY-123]'
}
});
// Method 2: Authorization Bearer token
fetch('http://localhost:3000/api/users', {
headers: {
'Authorization': 'Bearer [YOUR-SECRET-KEY-123]'
}
});
// Method 3: Query parameter
fetch('http://localhost:3000/api/users?apiKey=[YOUR-SECRET-KEY-123]');
const db = new JSLiteDB({
enableServer: true,
enableRealtime: true,
serverPort: 3000
});
// Listen to client events
db.on('client:connected', ({ socketId }) => {
console.log('Client connected:', socketId);
});
db.on('client:disconnected', ({ socketId, reason }) => {
console.log('Client disconnected:', socketId, reason);
});
HTML + Socket.io:
<script src="/socket.io/socket.io.js"></script>
<script>
const socket = io('http://localhost:3000');
socket.on('collections:init', (data) => {
console.log('Available collections:', data.collections);
});
socket.on('connect', () => {
console.log('Connected to JSLiteDB server');
});
</script>
React Example:
import { useEffect, useState } from 'react';
import io from 'socket.io-client';
function App() {
const [collections, setCollections] = useState([]);
const [socket, setSocket] = useState(null);
useEffect(() => {
const newSocket = io('http://localhost:3000');
newSocket.on('collections:init', (data) => {
setCollections(data.collections);
});
setSocket(newSocket);
return () => newSocket.close();
}, []);
return (
<div>
<h1>Available Collections:</h1>
<ul>
{collections.map(name => (
<li key={name}>{name}</li>
))}
</ul>
</div>
);
}
POST /api/:collection - Create documentGET /api/:collection - Get all documentsGET /api/:collection/:id - Get document by IDPUT /api/:collection/:id - Update documentDELETE /api/:collection/:id - Delete documentGET /api/:collection/count - Get document countGET /api/health - Health checkGET /api/stats - Database statisticsPOST /api/backup - Create backupPOST /api/restore - Restore from backup?limit=N - Limit results?skip=N - Skip results (pagination)?apiKey=KEY - Authentication (alternative to headers)const db = new JSLiteDB();
const users = db.collection('users');
// Basic operations
await users.insert({ name: 'John', age: 25 });
await users.findById('user123');
await users.update('user123', { age: 26 });
await users.delete('user123');
// Queries
const results = await users.find()
.where('age', '>', 18)
.sort('name', 'asc')
.limit(10)
.values();
const db = new JSLiteDB({
enableServer: true,
enableRealtime: true,
serverPort: 3000
});
// Listen to client events
db.on('client:connected', ({ socketId }) => {
console.log('Client connected:', socketId);
});
db.on('client:disconnected', ({ socketId }) => {
console.log('Client disconnected:', socketId);
});
JSLiteDB is dual-licensed.
Free for open source projects and applications that comply with AGPL-3.0 terms.
For proprietary applications and commercial use without AGPL-3.0 restrictions.
Need a commercial license?
See COMMERCIAL_LICENSE.md for details.
JSLiteDB is a fork of sehawq.db by Omer (sehawq). Special thanks to the original author for creating the foundation that made this project possible. 🙇♂️
FAQs
Lightweight JSON-based database for JavaScript-based apps with real-time sync, REST API, and zero configuration.
We found that jslitedb demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.