
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@acdibble/tuql
Advanced tools
Pronounced: Too cool
tuql is a simple tool that turns a sanely formatted sqlite database into a graphql endpoint. It tries to infer relationships between objects, currently supporting belongsTo, hasMany and belongsToMany. It also forms the basic mutations necessary to create, update, and delete objects, as well as assoicate many-to-many relationships.
npm install -g tuql
tuql --db path/to/database.sqlite
You can also optionally set the port and enable graphiql:
tuql --db path/to/database.sqlite --port 8888 --graphiql
Or, you can use a sql file with statements to build up an in-memory database:
tuql --infile path/to/db_dump.sql --graphiql
If you'd like to print out the schema itself, use:
tuql --db path/to/database.sqlite --schema
Or send it to a file:
tuql --db path/to/database.sqlite --schema > schema.graphql
Imagine your sqlite schema looked something like this:
| posts | users | categories | category_post |
|---|---|---|---|
| id | id | id | category_id |
| user_id | username | title | post_id |
| title | |||
| body |
tuql will automatically define models and associations, so that graphql queries like this will work right out of the box:
{
posts {
title
body
user {
username
}
categories {
title
}
}
}
tuql works one of two ways. It prefers to map your schema based on the foreign key information in your tables. If foreign keys are not present, tuql assumes the following about your schema in order to map relationships:
id or thing_id or thingId, where thing is the singular form of the table name. Example: For a table named posts, the primary key column should be named id, post_id or postId.thing_id or thingId, where thing is the singular form of the associated table.foo_bar or bar_foo (ordering is not important). The columns should follow the same pattern as #2 above.FAQs
_Pronounced: Too cool_
The npm package @acdibble/tuql receives a total of 1 weekly downloads. As such, @acdibble/tuql popularity was classified as not popular.
We found that @acdibble/tuql demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.