sequelize

Sequelize is a promise-based Node.js ORM tool for Postgres, MySQL, MariaDB, SQLite, Microsoft SQL Server, Amazon Redshift and Snowflake’s Data Cloud. It features solid transaction support, relations, eager and lazy loading, read replication and more.

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require in connection-manager.js is the documented dialectModulePath feature of Sequelize; not malicious in context.	ai	2026/04/21
semgrep	semgrep:hex-decode	AI (semgrep): Hex decode in postgres/data-types.js is standard WKB geometry parsing via wkx; not a malicious payload.	ai	2026/04/21
phantom-deps	phantom-dep:@types/debug	AI (phantom-deps): Sequelize ships @types/* as runtime deps by design; this is a known pattern for this package.	ai	2026/04/21
phantom-deps	phantom-dep:@types/validator	AI (phantom-deps): Sequelize ships @types/* as runtime deps by design; this is a known pattern for this package.	ai	2026/04/21

Version	Deps	Published