Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
pg-parameters
Advanced tools
pg-parameters
is a postgres client library that supports queries with named parameters.
The pg
module supports parameterized queries, however, the queries need to be defined using ordinal parameters ($1
, $2
, etc.), and the parameters must be passed in as an array. The purpose of this library is enable queries to be defined and executed more intuitively using named parameters.
This library uses parameter names preceded by a colon (:
), example: :parameter_name
.
Explicitly named parameters:
const rows = await client.query(`
select
key,
value
from key_value
where id = :id;
`, { id: 1 });
Instead of:
const { rows } = await client.query(`
select
key,
value
from key_value
where id = $1;
`, [ 1 ]);
Installation is done via npm
. Example:
npm install --save pg-parameters
Some of the other features include:
rows
/row
directly from query
/querySingle
methods
pg
result is available using the execute
methodtypescript
definitionsimport { Client } from 'pg-query';
const client = new Client({
host: 'localhost',
user: 'postgres',
password: '<password>',
database: 'postgres',
});
async function dbExample() {
// create new table
await client.execute(`
create table if not exists key_value (
id serial primary key,
key text not null,
value text
);`);
// insert new record
const newRecord = await client.insert(`key_value`, {
key: 'test',
value: 'value',
}, 'id');
console.log('New record inserted, id:', newRecord.id);
// select new record
const record = await client.querySingle(`
select
key,
value
from key_value
where id = :id;`, { id: newRecord.id });
console.log('Record retrieved:', record);
// select multiple records
const records = await client.query(`
select
id,
key,
value
from key_value
where key = :key
and value is not null;`, { key: 'test' });
console.log('Records retrieved:', records);
}
dbExample().then(() => {
process.exit();
});
FAQs
Postgres named parameters query library
The npm package pg-parameters receives a total of 1 weekly downloads. As such, pg-parameters popularity was classified as not popular.
We found that pg-parameters demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.