
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
sequelize
Advanced tools
Sequelize is a promise-based Node.js ORM tool for Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server. It features solid transaction support, relations, eager and lazy loading, read replication and more.
Sequelize follows Semantic Versioning and supports Node v10 and above.
New to Sequelize? Take a look at the Tutorials and Guides. You might also be interested in the API Reference.
Would you like to contribute? Read our contribution guidelines to know more. There are many ways to help.
You can find the detailed changelog here.
Recently, a bigger part of the former core maintainers (thanks to all your hard work!) have been rather busy. Hence, the available time to look after our beloved ORM has been shrinking and shrinking drastically, generating a great chance for you:
We are looking for more core maintainers who are interested in improving/fixing our TypeScript typings, improving the documentation, organizing issues, reviewing PRs, streamlining the overall code base and planning the future roadmap.
If that sounds interesting to you, please reach out to us on our Slack channel by sending a direct message to Pedro A P B. If you don't have access, get yourself an invite automatically via this link. We are looking forward to meet you!
$ npm i sequelize # This will install v6
# And one of the following:
$ npm i pg pg-hstore # Postgres
$ npm i mysql2
$ npm i mariadb
$ npm i sqlite3
$ npm i tedious # Microsoft SQL Server
If you have security issues to report, please refer to our Responsible Disclosure Policy for more details.
Mongoose is an ODM (Object Data Modeling) library for MongoDB and Node.js. It manages relationships between data, provides schema validation, and is used to translate between objects in code and the representation of those objects in MongoDB. Compared to Sequelize, Mongoose is specific to MongoDB, whereas Sequelize supports multiple SQL databases.
TypeORM is an ORM that can run in Node.js and be used with TypeScript and JavaScript (ES5, ES6, ES7, ES8). It supports the Data Mapper pattern, unlike Sequelize which is more Active Record. TypeORM is highly influenced by other ORMs, such as Hibernate, Doctrine, and Entity Framework.
Knex.js is a SQL query builder for Postgres, MSSQL, MySQL, MariaDB, SQLite3, Oracle, and Amazon Redshift, designed to be flexible, portable, and fun to use. It does not provide full ORM capabilities but allows you to build and run SQL queries in a more programmatic and database-agnostic way. It is often used with objection.js, which is an ORM built on top of Knex.
Bookshelf.js is a JavaScript ORM for Node.js, built on the Knex SQL query builder. It features transaction support, eager/nested-eager relation loading, and polymorphic associations. Bookshelf follows a somewhat similar pattern to Sequelize but is built on top of Knex, which gives it a different flavor in terms of query building.
FAQs
Sequelize is a promise-based Node.js ORM tool for Postgres, MySQL, MariaDB, SQLite, Microsoft SQL Server, Amazon Redshift and Snowflake’s Data Cloud. It features solid transaction support, relations, eager and lazy loading, read replication and more.
The npm package sequelize receives a total of 2,409,679 weekly downloads. As such, sequelize popularity was classified as popular.
We found that sequelize demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.