
Research
/Security News
60 Malicious Ruby Gems Used in Targeted Credential Theft Campaign
A RubyGems malware campaign used 60 malicious packages posing as automation tools to steal credentials from social media and marketing tool users.
github.com/FrauElster/GopenApiToGraphQL
This project transforms OpenAPI schemas to GraphQL schemas.
I was originally using IBM`s openapi-to-graphql, and advise everyone to use it. It is battle-tested (according to the GitHub Stars) and has probably way more edge cases covered.
I am currently developing an OpenAPI to GraphQL proxy. This project uses 3 awesome tools under the hood
Number 1. and 3. are go projects, number 2. is a Node project. There lays the first reason why I decided to write an alternative.
A Node project means so much more stuff, e.g. package.json, package.lock, node_modules, npm has to be installed,
npx installs everything everytime, ...
Number 2. and the more severe thing: it uses a different validator than oapi-codegen.
I am pretty sure it uses IBMs openapi-validator](https://github.com/IBM/openapi-validator) which is fairly strict, whereas oapi-codegen uses [getkin
s kin-openapi.
No I do have some public available OpenAPI services I want to use and generate GraphQL proxies for, and these server`s schemas
are sometime not good enough to get parsed by openapi-to-graphql.
So I thought, if I would have to fork and modify openapi-to-graphql anyway, I could also write it in Go and get all the JS dependency and tooling out of my project.
There is probably a lot of open issues right now. I will edit it going along, everytime I found severe problems with it. I know that a lot can be done better, I am working on this for like 10 hours and is a more quick and dirty approach at the time.
Feel free to contribute and give me some PRs, if you want to.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A RubyGems malware campaign used 60 malicious packages posing as automation tools to steal credentials from social media and marketing tool users.
Security News
The CNA Scorecard ranks CVE issuers by data completeness, revealing major gaps in patch info and software identifiers across thousands of vulnerabilities.
Research
/Security News
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.