
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
pouchdb-persist
Advanced tools
Persistent replication in PouchDB
The replicate() routines in PouchDB are not fault-tolerant and will stop replicating if there are any network disruptions. PouchDB Persist implements an exponential backoff routine that will keep retrying until your connection is restored.
var db = new PouchDB('todos');
// Instead of db.replicate()
var persist = db.persist({ url: 'http://localhost:5984/todos' });
This will automatically start the replication.
var db = new PouchDB('todos');
var persist = db.persist({
url: 'http://localhost:5984/todos',
manual: true, // requires explict call to start replication
to: {
listeners: [{ method: 'on', event: 'uptodate', listener: function () {
console.log('uptodate');
}}]
}
});
persist.on('connect', function () {
console.log('connect');
});
persist.on('disconnect', function () {
console.log('disconnect');
});
persist.start().then(function () {
persist.stop().then(function () {
persist.start();
});
});
To use this plugin, include it after pouchdb.js in your HTML page:
<script src="pouchdb.js"></script>
<script src="pouchdb-persist.js"></script>
Or install it via bower:
bower install pouchdb-persist
Or to use it in Node.js, just npm install it:
npm install pouchdb-persist
And then attach it to the PouchDB object:
var PouchDB = require('pouchdb');
PouchDB.plugin(require('pouchdb-persist'));
Create persistence
var persist = db.persist(opts);
where any of the options can be blank except the url. Here is an example:
{
url: 'http://localhost:5984/todos', // remote Couch URL
maxTimeout: 60000, // max retry timeout, defaulted to 300000
startingTimeout: 1000, // retry timeout, defaulted to 1000
backoff: 1.1, // exponential backoff factor, defaulted to 1.1
manual: false, // when true, start replication with start()
changes: { // options for changes()
opts: { live: true }
},
to: { // options for replicating to remote source
opts: { live: true }, // replicate.to() options
url: 'http://localhost:5984/todos', // remote URL
onErr: function (err) { }, // error handler
listeners: [{ method: 'once', event: 'uptodate', listener: function () { } }]
},
from: { // options for replicating from remote source
opts: { live: true }, // replicate.from() options
url: 'http://localhost:5984/todos', // remote URL
onErr: function (err) { }, // error handler
listeners: [{ method: 'once', event: 'uptodate', listener: function () { } }]
}
}
Start replication
persist.start([direction]);
where direction can be persist.BOTH, persist.TO or persist.FROM and is defaulted to persist.BOTH
Stop replication
persist.stop([direction]);
where direction can be persist.BOTH, persist.TO or persist.FROM and is defaulted to persist.BOTH
Listen for connect event
persist.on('connect', function () {
console.log('connect');
});
Note: persist is also an EventEmitter and therefore has methods like once, removeListener, etc...
Listen for disconnect event
persist.on('disconnect', function () {
console.log('disconnect');
});
Note: you must have couchdb installed and running and have Admin Party enabled
npm install
npm run dev
Visit the target example in your browser, e.g. http://127.0.0.1:8001/examples
Interested in contributing?
FAQs
PouchDB plugin for persistent replication
We found that pouchdb-persist demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.