Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Codemod tool to detect gql tag templates and extract them to separate files
By default, this codemod finds all gql
tag usage from graphql-tag
imports of a given pattern. Then, it analyses and puts GraphQL content and fragments into a separate .graphql
file.
# This codemods all .ts and .tsx files under path/to/files that import and use gql tag
$ npx 0gql@latest "path/to/files/*.ts*"
There are other options as well. Check the full options in the Options section.
Usage: 0gql [options] <file pattern>
Options:
-V, --version output the version number
-e, --extension <target extension> extension of the generated file/s (default: ".graphql")
-m, --modules <gql tag module/s> module/s where gql tag are imported from. Comma separated (default: "graphql-tag")
-r, --remove remove original gql tag usage
-h, --help display help for command
0.0.10
b42c152: Add handling for default exports of gql tags.
Improve backtick handling - only start and end backticks are removed, and escaped backticks in the middle of a template are unescaped.
FAQs
Migrate from gql tag
The npm package 0gql receives a total of 26 weekly downloads. As such, 0gql popularity was classified as not popular.
We found that 0gql demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.