
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
nukak-postgres
Advanced tools
flexible and efficient ORM, with declarative JSON syntax and smart type-safety
nukak is the smartest ORM for TypeScript, it is designed to be fast, safe, and easy to integrate into any application.
It can run in Node.js, Browser, React Native, NativeScript, Expo, Electron, Deno, Bun, and much more!
Uses a consistent API for distinct databases, including PostgreSQL, MySQL, MariaDB, and SQLite (inspired by MongoDB glorious syntax).
const companyUsers = await userRepository.findMany({
$select: { email: true, profile: { $select: { picture: true } } },
$where: { email: { $endsWith: '@domain.com' } },
$sort: { createdAt: 'desc' },
$limit: 100,
});
See this article in medium.com.
TypeScript for auto-completion and validation of operators at any depth, including relations and their fields.QueryContext pattern to ensure perfectly indexed placeholders ($1, $2, etc.) and robust SQL fragment management, even in the most complex sub-queries.PostgreSQL, MySQL, MariaDB, SQLite, and even MongoDB.100% valid JSON, allowing them to be easily transported from frontend to backend.CamelCase and database snake_case (or any custom format) with a pluggable system.@Serialized() decorator ensure database operations are thread-safe and race-condition free by default.ESM support, designed for Node.js, Bun, Deno, and even mobile/browser environments.JSON, JSONB, and Vector types.
Install the core package:
npm install nukak --save
Install one of the specific adapters for your database:
| Database | Driver | Nukak Adapter |
|---|---|---|
PostgreSQL | pg | nukak-postgres |
SQLite | sqlite sqlite3 | nukak-sqlite |
MariaDB | mariadb | nukak-maria |
MySQL | mysql2 | nukak-mysql |
For example, for Postgres install the pg driver and the nukak-postgres adapter:
npm install pg nukak-postgres --save
Additionally, your tsconfig.json may need the following flags:
"target": "es2022",
"experimentalDecorators": true,
"emitDecoratorMetadata": true
Annotate your classes with decorators from nukak/entity. Nukak supports detailed schema metadata for precise DDL generation.
import { Entity, Id, Field, OneToOne, OneToMany, ManyToOne, ManyToMany } from 'nukak/entity';
import type { Relation } from 'nukak/type';
@Entity()
export class User {
@Id()
id?: string;
@Field({ length: 100, index: true })
name?: string;
@Field({ unique: true, comment: 'User login email' })
email?: string;
@OneToOne({ entity: () => Profile, mappedBy: 'user', cascade: true })
profile?: Relation<Profile>; // Relation<T> handles circular dependencies
@OneToMany({ entity: () => Post, mappedBy: 'author' })
posts?: Relation<Post>[];
}
@Entity()
export class Profile {
@Id()
id?: string;
@Field()
bio?: string;
@Field({ reference: () => User })
userId?: string;
@OneToOne({ entity: () => User })
user?: User;
}
@Entity()
export class Post {
@Id()
id?: number;
@Field()
title?: string;
@Field({ reference: () => User })
authorId?: string;
@ManyToOne({ entity: () => User })
author?: User;
@ManyToMany({ entity: () => Tag, through: () => PostTag })
tags?: Tag[];
}
@Entity()
export class Tag {
@Id()
id?: string;
@Field()
name?: string;
}
@Entity()
export class PostTag {
@Id()
id?: string;
@Field({ reference: () => Post })
postId?: number;
@Field({ reference: () => Tag })
tagId?: string;
}
A querier-pool can be set in any of the bootstrap files of your app (e.g. in the server.ts).
// file: ./shared/orm.ts
import { SnakeCaseNamingStrategy } from 'nukak';
import { PgQuerierPool } from 'nukak-postgres';
export const querierPool = new PgQuerierPool(
{
host: 'localhost',
user: 'theUser',
password: 'thePassword',
database: 'theDatabase',
min: 1,
max: 10,
},
// Optional extra options.
{
// Optional, any custom logger function can be passed here (optional).
logger: console.debug,
// Automatically translate between TypeScript camelCase and database snake_case.
// This affects both queries and schema generation.
namingStrategy: new SnakeCaseNamingStrategy()
},
);
Nukak provides multiple ways to interact with your data, from low-level Queriers to high-level Repositories.
Repositories provide a clean, Data-Mapper style interface for your entities.
import { GenericRepository } from 'nukak/repository';
import { User } from './shared/models/index.js';
import { querierPool } from './shared/orm.js';
// Get a querier from the pool
const querier = await querierPool.getQuerier();
try {
const userRepository = new GenericRepository(User, querier);
// Advanced querying with relations and virtual fields
const users = await userRepository.findMany({
$select: {
id: true,
name: true,
profile: ['picture'], // Select specific fields from a 1-1 relation
tagsCount: true // Virtual field (calculated at runtime)
},
$where: {
email: { $iincludes: 'nukak' }, // Case-insensitive search
status: 'active'
},
$sort: { createdAt: -1 },
$limit: 50
});
} finally {
// Always release the querier to the pool
await querier.release();
}
Nukak's query syntax is context-aware. When you query a relation, the available fields and operators are automatically suggested and validated based on that related entity.
import { GenericRepository } from 'nukak/repository';
import { User } from './shared/models/index.js';
import { querierPool } from './shared/orm.js';
const authorsWithPopularPosts = await querierPool.transaction(async (querier) => {
const userRepository = new GenericRepository(User, querier);
return userRepository.findMany({
$select: {
id: true,
name: true,
profile: {
$select: ['bio'],
// Filter related record and enforce INNER JOIN
$where: { bio: { $ne: null } },
$required: true
},
posts: {
$select: ['title', 'createdAt'],
// Filter the related collection directly
$where: { title: { $iincludes: 'typescript' } },
$sort: { createdAt: -1 },
$limit: 5
}
},
$where: {
name: { $istartsWith: 'a' }
}
});
});
Define complex logic directly in your entities using raw functions from nukak/util. These are highly efficient as they are resolved during SQL generation.
import { Entity, Id, Field } from 'nukak/entity';
import { raw } from 'nukak/util';
import { ItemTag } from './shared/models/index.js';
@Entity()
export class Item {
@Id()
id: number;
@Field()
name: string;
@Field({
virtual: raw(({ ctx, dialect, escapedPrefix }) => {
ctx.append('(');
dialect.count(ctx, ItemTag, {
$where: {
itemId: raw(({ ctx }) => ctx.append(`${escapedPrefix}.id`))
}
}, { autoPrefix: true });
ctx.append(')');
})
})
tagsCount?: number;
}
Nukak ensures your operations are serialized and thread-safe.
import { User, Profile } from './shared/models/index.js';
import { querierPool } from './shared/orm.js';
const result = await querierPool.transaction(async (querier) => {
const user = await querier.findOne(User, { $where: { email: '...' } });
const profileId = await querier.insertOne(Profile, { userId: user.id, ... });
return { userId: user.id, profileId };
});
// Connection is automatically released after transaction
Nukak provides a robust migration system and an "Entity-First" synchronization engine to manage your database schema changes.
Install the migration package:
npm install nukak-migrate --save
Create a nukak.config.ts for the CLI:
import { PgQuerierPool } from 'nukak-postgres';
import { User, Post, Profile } from './src/entities/index.js';
import { SnakeCaseNamingStrategy } from 'nukak';
export default {
querierPool: new PgQuerierPool({ /* config */ }),
dialect: 'postgres',
entities: [User, Post, Profile],
namingStrategy: new SnakeCaseNamingStrategy(),
migrationsPath: './migrations'
};
Manage your schema via CLI:
# Generate a migration by comparing entities vs database
npx nukak-migrate generate:entities initial_schema
# Run pending migrations
npx nukak-migrate up
# Rollback the last migration
npx nukak-migrate down
In development, you can use autoSync to automatically keep your database in sync with your entities without manual migrations. It is safe by default, meaning it only adds missing tables and columns.
import { Migrator } from 'nukak-migrate';
import { querierPool } from './shared/orm.js';
const migrator = new Migrator(querierPool);
// Automatically sync changes on your entities with the DB tables/columns (recommended for development only)
const migrator = new Migrator(querierPool);
await migrator.autoSync({ logging: true });
Check out the full nukak-migrate README for detailed CLI commands and advanced usage.
Check out the full documentation at nukak.org for details on:
For those who want to see the "engine under the hood," check out these resources in the source code:
FAQs
flexible and efficient ORM, with declarative JSON syntax and smart type-safety
The npm package nukak-postgres receives a total of 2 weekly downloads. As such, nukak-postgres popularity was classified as not popular.
We found that nukak-postgres demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.