
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Resilient Postgres listen client
This project is not in any production use by the author. There has also been
very little community engagement on the module that would motivate the
extensive time investment to make this module as good as pg-listen. Given
that module has more usage and is actively maintained I would strongly
recommend using that instead.
LISTEN statements accumulate$ npm install --save pg-ears
pg-ears exports a single function takes the same options as a new
node-postgres new Client(opts) with a couple additions and returns an object
containing the methods listen and notify
listen(channel, callback)
(error, data) as arguments OR with an error when the PG client
encounters an errornotify(channel, payload, callback)
const options = {
user: 'foo', //env var: PGUSER
database: 'my_db', //env var: PGDATABASE
password: 'secret', //env var: PGPASSWORD
host: 'localhost', // Server hosting the postgres database
port: 5432 //env var: PGPORT
}
const pgEars = require('pg-ears')(options)
pgEars.listen('mychannel', (err, data) => {
if (err) return console.error(err)
console.log(data)
})
pgEars.notify('mychannel', {key: 'value'}, (err) => {
if (err) console.error(err)
})
:warning: Channel names in postgresql are identifiers, just like the name of a
table or a column.
Please refer to the offical postgresql documentation about valid identifiers.
node-postgres does not currently allows channel names to be parameterized to avoid sql-injection attacks.
See node-postgres issue #1258 for details.
pg-ears performs no validation or sanitation on the channel names and they are inserted into the sql queries as-is.
On the other hand, payloads of your notifications are json encoded and decoded automatically by pg-ears and passed using safe parameterized queries.
MIT © Andrew Carpenter
FAQs
Resilient Postgres listen client
The npm package pg-ears receives a total of 70 weekly downloads. As such, pg-ears popularity was classified as not popular.
We found that pg-ears demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.