
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@graphox/darwin-arm64
Advanced tools
A high-performance GraphQL toolset for TypeScript monorepos, providing LSP, type generation, and validation.
Language Server (LSP)
Type Generation (Codegen)
Supported Formats
.graphql filesgql, graphql tags)Install the CLI
pnpm add @graphox/cli
Create configuration
# graphox.yaml
projects:
- schema: "schema.graphql"
include: "src/**/*.{ts,tsx}"
output_dir: "__generated__"
Set up your editor - See Editor Setup
Run commands
pnpm graphox check # Validate GraphQL files
pnpm graphox codegen # Generate TypeScript types
pnpm graphox lsp # Start LSP (for editors)
Install via pnpm to automatically download the correct binary for your platform:
pnpm add @graphox/cli
npm install @graphox/cli
yarn add @graphox/cli
Then use with pnpm:
pnpm graphox lsp
pnpm graphox check
pnpm graphox codegen
Or install globally:
pnpm add -g @graphox/cli
graphox lsp
graphox check
graphox codegen
Download pre-built binaries from the releases page for:
Optimize bundle size by ensuring GraphQL AST files are properly codesplit.
| Build Tool | Plugin | Documentation |
|---|---|---|
| rsbuild | SWC Plugin | plugins/swc/README.md |
| Turbopack/Next.js | SWC Plugin | plugins/swc/README.md |
| React Native (Metro) | Babel Plugin | plugins/babel/README.md |
| Webpack | Babel Plugin | plugins/babel/README.md |
Set up Graphox as a language server in your editor:
| Editor | Setup Guide |
|---|---|
| VSCode | editors/vscode/README.md |
| Neovim | editors/neovim.md |
| IntelliJ | editors/intellij.md |
VSCode: Install the Graphox extension or use the npm package.
Neovim: Configure LSP with nvim-lspconfig:
require('lspconfig').graphox.setup({
cmd = { 'pnpm', 'exec', 'graphox', 'lsp' },
filetypes = { 'graphql', 'typescript', 'typescriptreact' },
})
IntelliJ/JetBrains: Install LSP4IJ plugin and configure to run pnpm exec graphox lsp.
# Start the Language Server
graphox lsp
# Validate GraphQL files
graphox check
# Generate TypeScript types
graphox codegen
graphox codegen --clean # Remove generated files and caches
graphox codegen --watch # Watches and runs codegen of file changes
# Run performance benchmarks
graphox benchmark
check - Validates all GraphQL files against the schemacodegen - Generates TypeScript types for operationslsp - Starts the Language Server Protocol serverCreate a graphox.yaml file in your project root.
projects:
- schema: "schema.graphql"
include: "src/**/*.{ts,tsx}"
exclude: "**/*.test.ts"
output_dir: "__generated__"
See Common Configurations for detailed examples including:
graphox.yaml or graphox.yml**/*.ts, src/**/*.{ts,tsx})See Validation Rules for configuring validation rules.
Use @public to make fragments available for import in other projects within your monorepo:
# In package-a/fragments.graphql
fragment UserFields on User @public {
id
name
email
}
# In package-b/query.graphql
query GetUser($id: ID!) {
user(id: $id) {
...UserFields # Imports from package-a
}
}
Generated TypeScript types will automatically import the fragment type:
// package-b/query.codegen.ts
import type { UserFields } from "@workspace/package-a";
export interface GetUserQuery {
user: ({ __typename: "User" } & UserFields) | null;
}
Configuration requirement: Set the import field in your project config to specify how other projects should import from it:
projects:
- schema: "schema.graphql"
include: "packages/package-a/**/*.graphql"
import: "@workspace/package-a" # Other projects import from here
- schema: "schema.graphql"
include: "packages/package-b/**/*.graphql"
import: "@workspace/package-b"
Use @type_only for fragments that are only used for TypeScript types and never used in actual GraphQL queries:
# Define reusable type-only fragment
fragment UserBaseFields on User @type_only {
id
name
}
# Spread it in another fragment to compose types
fragment UserWithEmail on User {
...UserBaseFields
email
}
Generated types will include the fragment but no AST will be generated:
// Only type definition, no DocumentNode/AST
export interface UserBaseFields {
__typename: "User";
id: string;
name: string;
}
// Full fragment with AST
export interface UserWithEmail {
__typename: "User";
id: string;
name: string;
email: string;
}
export const UserWithEmailFragmentDocument = { /* AST */ };
This prevents warnings about unused fragments for these as the tool is not following use of the typescript types.
The LSP will warn if you accidentally use a @type_only fragment in a query and provide a code action to remove it.
See CONTRIBUTING.md for detailed information on:
See docs/architecture.md for in-depth documentation on:
See docs/configurations.md for:
FAQs
Graphox CLI binary for darwin-arm64
We found that @graphox/darwin-arm64 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.