
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
PostgreSQL environment configuration utilities for managing database connection settings.
npm install pg-env
import { PgConfig, getPgEnvOptions } from 'pg-env';
// Get PostgreSQL config from environment with defaults
const config = getPgEnvOptions();
console.log(config);
// { host: 'localhost', port: 5432, user: 'postgres', ... }
// Override specific values
const customConfig = getPgEnvOptions({
database: 'myapp',
port: 5433
});
import { getPgEnvVars, toPgEnvVars } from 'pg-env';
// Read current PostgreSQL environment variables
const envVars = getPgEnvVars();
// Returns partial PgConfig from PGHOST, PGPORT, etc.
// Convert config to environment variables
const config: PgConfig = {
host: 'db.example.com',
port: 5432,
user: 'appuser',
password: 'secret',
database: 'myapp'
};
const envVars = toPgEnvVars(config);
// { PGHOST: 'db.example.com', PGPORT: '5432', ... }
import { getSpawnEnvWithPg } from 'pg-env';
import { spawn } from 'child_process';
// Create environment for spawning processes
const env = getSpawnEnvWithPg({
database: 'testdb',
user: 'testuser'
});
// Use with child processes
const child = spawn('psql', [], { env });
PgConfiginterface PgConfig {
host: string;
port: number;
user: string;
password: string;
database: string;
}
getPgEnvOptions(overrides?: Partial<PgConfig>): PgConfig - Get config from environment with overridesgetPgEnvVars(): Partial<PgConfig> - Parse PostgreSQL environment variablestoPgEnvVars(config: Partial<PgConfig>): Record<string, string> - Convert config to env varsgetSpawnEnvWithPg(config: Partial<PgConfig>, baseEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv - Create spawn environmentdefaultPgConfig: PgConfig - Default PostgreSQL configurationThe package reads the following environment variables:
PGHOST - Database hostPGPORT - Database port (parsed as number)PGUSER - Database userPGPASSWORD - Database passwordPGDATABASE - Database name🚀 Quickstart: Getting Up and Running Get started with modular databases in minutes. Install prerequisites and deploy your first module.
📦 Modular PostgreSQL Development with Database Packages Learn to organize PostgreSQL projects with pgpm workspaces and reusable database modules.
✏️ Authoring Database Changes Master the workflow for adding, organizing, and managing database changes with pgpm.
🧪 End-to-End PostgreSQL Testing with TypeScript Master end-to-end PostgreSQL testing with ephemeral databases, RLS testing, and CI/CD automation.
⚡ Supabase Testing Use TypeScript-first tools to test Supabase projects with realistic RLS, policies, and auth contexts.
💧 Drizzle ORM Testing Run full-stack tests with Drizzle ORM, including database setup, teardown, and RLS enforcement.
🔧 Troubleshooting Common issues and solutions for pgpm, PostgreSQL, and testing.
SET LOCAL) into queries—ideal for setting role, jwt.claims, and other session settings.libpg_query, converting SQL into parse trees.🛠 Built by the Constructive team — creators of modular Postgres tooling for secure, composable backends. If you like our work, contribute on GitHub.
AS DESCRIBED IN THE LICENSES, THE SOFTWARE IS PROVIDED "AS IS", AT YOUR OWN RISK, AND WITHOUT WARRANTIES OF ANY KIND.
No developer or entity involved in creating this software will be liable for any claims or damages whatsoever associated with your use, inability to use, or your interaction with other users of the code, including any direct, indirect, incidental, special, exemplary, punitive or consequential damages, or loss of profits, cryptocurrencies, tokens, or anything else of value.
FAQs
PostgreSQL environment configuration utilities
We found that pg-env demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.