
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@sucoza/graphql-devtools-plugin
Advanced tools
DevTools plugin for GraphQL query analysis, debugging, and schema introspection
A comprehensive GraphQL DevTools plugin for TanStack DevTools that provides advanced schema exploration, visual query building, operation monitoring, and performance analytics.
npm install @sucoza/graphql-devtools-plugin
import { GraphQLDevToolsPanel, createGraphQLDevToolsClient } from '@sucoza/graphql-devtools-plugin';
// Create the DevTools client
const graphqlDevToolsClient = createGraphQLDevToolsClient();
// Add to your app
function App() {
return (
<div>
{/* Your app content */}
{/* DevTools panel */}
<GraphQLDevToolsPanel />
</div>
);
}
import { TanStackDevtools } from '@tanstack/react-devtools';
import { GraphQLDevToolsPanel } from '@sucoza/graphql-devtools-plugin';
function App() {
return (
<div>
{/* Your app content */}
<TanStackDevtools>
<GraphQLDevToolsPanel />
</TanStackDevtools>
</div>
);
}
Configure endpoints for automatic schema introspection:
import { createGraphQLDevToolsClient } from '@sucoza/graphql-devtools-plugin';
const client = createGraphQLDevToolsClient();
// Add GraphQL endpoints
const schemaManager = client.getSchemaManager();
schemaManager.updateOptions({
endpoints: ['http://localhost:4000/graphql', '/api/graphql'],
autoIntrospect: true,
cacheTimeout: 300000 // 5 minutes
});
Add custom headers for authenticated endpoints:
// Introspect with custom headers
await client.introspectSchema('http://localhost:4000/graphql', {
'Authorization': 'Bearer your-token',
'X-Custom-Header': 'value'
});
The plugin automatically intercepts GraphQL requests. Configure interception options:
const interceptor = client.getInterceptor();
interceptor.updateOptions({
enabled: true,
endpoints: ['/graphql', '/api/graphql'],
autoDetectEndpoints: true,
maxOperationHistory: 1000
});
const client = createGraphQLDevToolsClient();
// Schema operations
await client.introspectSchema(endpoint, headers);
client.getSchemaManager();
// Query builder
client.setQueryBuilderOperationType('query' | 'mutation' | 'subscription');
client.addQueryBuilderField(field);
client.generateQuery();
client.validateQueryBuilder();
// Operation management
client.clearOperations();
client.getFilteredOperations();
client.exportOperations();
// UI controls
client.selectTab('operations' | 'schema' | 'query-builder' | 'performance');
client.toggleRecording();
client.updateFilters(filters);
import { useGraphQLDevToolsStore } from '@sucoza/graphql-devtools-plugin';
function CustomComponent() {
const state = useGraphQLDevToolsStore();
return (
<div>
<p>Total operations: {state.operations.length}</p>
<p>Schema loaded: {state.schema.schema ? 'Yes' : 'No'}</p>
</div>
);
}
The example/ directory contains a full demo application showing all features:
cd example
npm install
npm run dev
The example includes:
npm run build
npm test
npm run test:ui
npm run dev
npm run typecheck
The plugin works best with GraphQL schemas that support introspection. Ensure your GraphQL server has introspection enabled:
// Apollo Server example
const server = new ApolloServer({
typeDefs,
resolvers,
introspection: true, // Enable introspection
playground: true // Optional: enable GraphQL Playground
});
MIT
Part of the @sucoza TanStack DevTools ecosystem.
FAQs
DevTools plugin for GraphQL query analysis, debugging, and schema introspection
We found that @sucoza/graphql-devtools-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.