
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
mysql2-orm
Advanced tools
🎲 An ORM built on MySQL2, designed to be intuitive, productive and focused on essential functionality
An ORM built on MySQL2, designed to be intuitive, productive and focused on essential functionality.
commit or rollback in a transaction.execute and query original methods from MySQL2 Pool class.any, as neither satisfies at all.See detailed specifications and usage in Documentation section for queries, advanced concepts and much more.
npm i mysql2-orm
If you are using TypeScript, you will need to install @types/node.
npm i -D @types/node
import { MySQL } from 'mysql2-orm';
const pool = new MySQL({
host: '',
user: '',
database: '',
// ...
});
The following example is based on TypeScript and ES Modules, but you can also use JavaScript and CommonJS.
const user = await pool.select({
table: 'users',
where: OP.eq('id', 16),
limit: 1,
});
limit: 1, it returns a direct object with the row result.RowDataPacket or false.It's equivalent to:
import mysql, { RowDataPacket } from 'mysql2/promise'; const pool = mysql.createPool({ // ... }); const [users] = execute<RowDataPacket[]>( 'SELECT * FROM `users` WHERE `id` = ? LIMIT ?', [16, '1'] ); const user = users?.[0] || false;
await pool.end();
While in English dice and data each have their own word, in Brazil, both the dice and "data" are called "dado" even though they refer to different things:
| 🇺🇸 English | 🇧🇷 Portuguese (BR) | |
|---|---|---|
| đź’ľ | data | dado |
| 🎲 | dice | dado |
FAQs
🎲 An ORM built on MySQL2, designed to be intuitive, productive and focused on essential functionality
The npm package mysql2-orm receives a total of 28 weekly downloads. As such, mysql2-orm popularity was classified as not popular.
We found that mysql2-orm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.