You shouldn't store credentials in your code repository regardless of whether it's for an API or a database, as any collaborators would then have access to your database. The most common approach is to use environment variables to make them configurable depending on which machine the code runs on.
If you are invoking Node from a Linux-like terminal such as Bash you can pass environment variables like this:
DB_HOST=mydb.com DB_USER=myUser node myscript.js
And in your code you'd access it through process.env:
const {
DB_HOST = 'localhost', // a non-sensitive default value
DB_USER = 'root',
} = process.env
const mariadb = require('mariadb')
const pool = mariadb.createPool({host: DB_HOST, user: DB_USER, connectionLimit: 5})
Because setting the environment variables every time you invoke the script from your terminal is tedious in the long run, bright people invented the concept of a dotenv (.env) file to store configurable variables in. The dotenv package will look for such a file and apply its values to the environment unless the properties are already defined.
Using it is as simple as creating a file called .env in your project root directory:
DB_HOST=mydb.com
DB_USER=myUser
Important: This file must be added to your .gitignore to avoid exposing your credentials to unintended viewers.
and modifying the previous script:
require('dotenv').config() // Add this to apply missing things to process.env before we read from it
const {
DB_HOST = 'localhost',
DB_USER = 'root',
} = process.env
const mariadb = require('mariadb')
const pool = mariadb.createPool({host: DB_HOST, user: DB_USER, connectionLimit: 5})
Further reading: The Twelve-Factor App - III. Config