Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Lil ORM is a lightweight and flexible ORM for Node.js, designed with a clear and intuitive API to simplify database operations. Engineered for adaptability, it enables efficient interaction with databases.
Lil ORM is a lightweight ORM designed for Node.js. This compact project prioritizes clarity and simplicity in its API, making it effortless to interact with SQL databases. Although it's a lightweight ORM, it boasts a robust set of capabilities, letting developers create intricate database queries with ease.
While Lil ORM is primarily intended as a learning resource and experimental project, its lean design and user-friendly approach make it a noteworthy tool for those looking to understand the nuances of building APIs without the complexity that often accompanies larger ORMs.
Please note: Lil ORM is currently not recommended for use in production environments (yet), but rather as a learning tool and sandbox for testing and development purposes
⚠️ API are subjected to change ⚠️
jsonEquals
and jsonContains
.OnInsert
and OnUpdate
hooks for custom logic during data operations.SELECT
clauses.npm i lil-orm pg
npm i lil-orm sqlite3
yarn add lil-orm pg
yarn add lil-orm sqlite3
@Entity('user')
class UserEntity {
@PrimaryKey({
autoIncrement: true,
})
@Column({
type: 'integer',
name: 'id',
})
id: number;
@Column({
type: 'text',
name: 'name',
})
name: string;
@Column({
type: 'text',
name: 'email',
})
email: string;
@Column({
type: 'json',
name: 'config',
})
config: any;
@Column({
type: 'boolean',
name: 'is_active',
})
isActive: boolean;
@Column({
type: "date",
name: "created_at",
})
@OnInsert(() => new Date())
createdAt: Date;
@Column({
type: "date",
name: "updated_at",
})
@OnInsert(() => new Date())
@OnUpdate(() => new Date())
updatedAt: Date;
}
⚠️ Warning: Important Configuration Required
To ensure proper functioning of the library, please make sure to configure your TypeScript project correctly.
"experimentalDecorators": true,
"emitDecoratorMetadata": true,
"esModuleInterop": true,
Other configurations
Option 1: Enable useDefineForClassFields
In your project's tsconfig.json
, add or modify the compilerOptions
section to include the following:
{
"compilerOptions": {
"useDefineForClassFields": true
}
}
Option 2: Initialize Every Property with Default Values
If you cannot enable useDefineForClassFields
or prefer not to modify your TypeScript configuration, make sure to explicitly initialize every property in your entity class with a default value.
For example:
@Entity('tableName')
class MyEntity {
@PrimaryKey({
autoIncrement: true,
})
@Column({
type: 'INTEGER'
})
id: number = 0;
@Column({
type: 'TEXT'
})
name: string = '';
// ...other properties
}
import { LilORM } from 'lil-orm';
const databaseConnectionString = ':memory:';
const module = new LilORM(databaseConnectionString);
(experimental API name)
module.createTable(UserEntity) //to create a table from an entity
//get repository
const repository = module.getRepository<UserEntity>(UserEntity);
//Insert
const userEntity = new UserEntity();
userEntity.id = 1;
userEntity.name = 'test';
userEntity.email = 'test@example.com';
userEntity.isActive = false;
userEntity.age = 42;
userEntity.config = null;
userEntity.createdAt = new Date();
await repository.insert(userEntity);
//Find by id
const users = await repository.retrieve(qb => qb.where('id').equals(1));
//Update
userEntity.name = 'updated';
await repository.update(userEntity, qb => qb.where('id').equals(1));
//Delete
await repository.delete({ id: 69 });
let user: any[] = lilOrm.retrieve<UserEntity>(
qb => qb.forEntity(UserEntity)
.where('isActive').equals(true)
.and('age').greaterThan(18)
.or('config').equals({ allowed: true })
.finalize(),
(data) => data)
@OnInsert
and @OnUpdate
Hooks@OnInsert
Executes custom logic before a new entity is saved. Commonly used to set creation timestamps.
@Column({ type: "date", name: "created_at" })
@OnInsert(() => new Date())
createdAt: Date;
@OnUpdate
Triggered automatically before an existing entity is updated. Typically used for updating modification timestamps.
@Column({ type: "date", name: "updated_at" })
@OnUpdate(() => new Date())
updatedAt: Date;
enableDebugMode
To assist in debugging and optimizing your SQL queries, you can enable a debug mode on your ORM repository instances. This mode logs the last SQL query executed, allowing you to review the raw SQL sent to the database.
const repository = lilOrm.getRepository(UserEntity);
repository.enableDebugMode();
Debug mode is intended for development and debugging purposes. Ensure it is disabled in production environments to avoid performance overhead and potential security risks.
FAQs
Lil ORM is a lightweight and flexible ORM for Node.js, designed with a clear and intuitive API to simplify database operations. Engineered for adaptability, it enables efficient interaction with databases.
The npm package lil-orm receives a total of 3 weekly downloads. As such, lil-orm popularity was classified as not popular.
We found that lil-orm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.