
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
@graphql-tools/load-files
Advanced tools
Check API Reference for more information about this package; https://www.graphql-tools.com/docs/api/modules/load_files_src
You can also learn more about File Loading in this chapter; https://www.graphql-tools.com/docs/schema-merging#file-loading
graphql-import allows you to import .graphql files into your JavaScript or TypeScript code. It is similar to @graphql-tools/load-files in that it helps modularize your GraphQL schema, but it focuses specifically on importing and merging .graphql files.
merge-graphql-schemas is a utility to merge multiple GraphQL schemas and resolver maps into a single schema. It provides similar functionality to @graphql-tools/load-files but is more focused on the merging aspect rather than file loading.
graphql-tag is a library that parses GraphQL schema language into the GraphQL AST. While it doesn't load files from the filesystem, it is often used in conjunction with file loading utilities to parse the loaded schema strings into AST nodes.
FAQs
A set of utils for faster development of GraphQL tools
The npm package @graphql-tools/load-files receives a total of 496,114 weekly downloads. As such, @graphql-tools/load-files popularity was classified as popular.
We found that @graphql-tools/load-files demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.