
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Yak is an ORM that maps RESTful resources to JavaScript models/collections.
Inspired by Backbone.js and Her, Yak is designed to build applications that are powered by a RESTful JSON API instead of a database. Yak uses window.fetch on the client, and
node-fetch on the server, which makes it really easy for you to write a persistence layer in an isomorphic fashion.
Yak is designed to be extremely lightweight, weighing in at less than 1kb. It's only dependency is the window.fetch API which is gaining native support in most browsers as of writing.
Run npm install yak-orm and then simply require it in your project.
Yak requires Node.js >= 4.0 to run on the server.
To run in a web browser environment you'll need native or polyfilled support for ES6 Promises, Object.assign, Fat Arrow Syntax, and the window.fetch API. It's also recommended that you use Webpack or Browserify to make your build.
var Yak = require('yak-orm');
var yak = new Yak({
host: "http://localhost:8080/"
});
var Fruit = yak.model({
name: "fruits"
});
// GET http://localhost:8000/fruits?color=red
// returns { fruits: [{ name: "apple", name: "pomegranate"}] }
Fruit.all({
where: {
color: 'red'
}
}).then(collection => {
collection.fruits.forEach(fruit => {
console.log(fruit.attrs.name);
});
});
Features that are on the roadmap but not yet currently implemented include:
Create a new Yak instance
// Create new Yak instance
var yak = new Yak({
host: "http://localhost:8080/"
});
Create a new model based on a Yak instance
// Model defintion
var User = yak.model({
name: "users",
parse: function(attrs) {
attrs.fullName = attrs.firstName + " " + attrs.lastName;
return attrs;
}
});
Create a new instance of a model
// Create a new user
var user = new User({
attrs: {
name: "John",
email: "john@doe.com"
},
headers: {
'Accept-Language' : 'en',
'Authentication-Token': 'abc123'
}
});
Retrieve a model from server
All arguments are optional
// GET http://localhost:8080/users/1?active=true
var user = User.get({
id: 5,
where: {
active: true
}
headers: {
'Accept-Language' : 'fa',
}
}).then(user => {
console.log("Retrieved user:", user.attrs);
}).catch(error => {
console.log(error);
});
Retrieve a collection of models from server
// GET http://localhost:8080/users
User.all().then(collection => {
collection.users.forEach(user => {
console.log(user.attrs.id, user.attrs.name);
});
});
Persist a model to server
If an id attribute is present a PATCH operation
will be performed to update an existing record
Otherwise a POST operation will be sent
to create the record on the endpoint.
// POST http://localhost:8080/users
var user = new User({ name: "Daniel" });
user.save().then(user => {
// Update user name
user.attrs.name = "Yak Yak"
// PATCH http://localhost:8080/users/(user.attrs.id)
return user.save()
}).catch(error => {
console.log(error);
});
Remove a model from server
var user = new User({ id: "5" });
// DELETE http://localhost:8080/users/5
user.destroy().then(user => {
console.log("Deleted user:", user.attrs.id);
}).catch(error => {
console.log(error);
});
Run tests:
npm test
Run tests with code coverage:
istanbul cover ./node_modules/mocha/bin/_mocha
FAQs
Yak is an ORM that maps REST resources to JavaScript models/collections
We found that yak-orm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.