Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@wundergraph/cosmo-to-apollo-schema
Advanced tools
An Apollo Gateway plugin to load the supergraph schema from WunderGraph Cosmo for easy migration.
An Apollo Gateway plugin/helper that helps you to import your subgraphs directly from your Cosmo execution config and compose it into a supergraph sdl. It supports multiple import methods, including:
import { ApolloGateway } from '@apollo/gateway';
import { ApolloServer } from '@apollo/server';
import { startStandaloneServer } from '@apollo/server/standalone';
// 1. Import Schema Loader
import { SchemaLoader } from '@wundergraph/cosmo-to-apollo-schema';
// 2. Configure with file, cdn or s3
const cosmoSchemaLoader = new SchemaLoader({
filePath: './cosmo-config.json',
});
// 3. Pass it to the gateway subgraphSdl
const gateway = new ApolloGateway({
supergraphSdl: cosmoSchemaLoader.supergraphSdl,
});
const server = new ApolloServer({
gateway,
});
startStandaloneServer(server);
At least one of CDN, S3 or file path must be provided.
SchemaLoaderOptions {
cdn?: CDNOptions;
s3?: S3Options;
filePath?: string;
/*** Defaults to 15000 (15 seconds) */
pollInterval?: number;
}
Poll the CDN for config file. The default interval is 15 seconds.
interface CDNOptions {
endpoint?: string;
token: string;
signatureKey?: string;
}
endpoint
: The url to the cdn. (default https://cosmo-cdn.wundergraph.com).
token
: The token for your Federated Graph. You can generate one with the token create command.
signatureKey
: The optional signature key is the one used to sign your config in your admission server.
Once you have a token generated using wgc router token create your_graph_name
, you can use it in your environment file (.env
) as shown below. This fetches from cosmo cloud as the default. Feel free to specify a signatureKey
if you have configured admission.
import dotenv from 'dotenv';
import { ApolloGateway } from '@apollo/gateway';
import { ApolloServer } from '@apollo/server';
import { startStandaloneServer } from '@apollo/server/standalone';
import { SchemaLoader } from '@wundergraph/cosmo-to-apollo-schema';
dotenv.config();
// Fetches from Cosmo Cloud CDN by default
const cosmoSchemaLoader = new SchemaLoader({
cdn: {
// Token for your federated graph on cosmo.
token: process.env.GRAPH_TOKEN,
},
pollInterval: 3000,
});
const gateway = new ApolloGateway({
supergraphSdl: cosmoSchemaLoader.supergraphSdl,
});
const server = new ApolloServer({
gateway,
});
startStandaloneServer(server).then(({ url }) => {
console.log(`🚀 Server ready at ${url}`);
});
The plugin watches for any config file changes for the provided path and updates the sdl accordingly.
filePath: string;
Poll your S3 bucket for the execution config. The default interval is 15 seconds.
interface S3Options {
endpoint: string;
port?: number;
accessKey: string;
secretKey: string;
region?: Region;
secure?: boolean;
bucketName: string;
objectPath: string;
}
FAQs
An Apollo Gateway plugin to load the supergraph schema from WunderGraph Cosmo for easy migration.
The npm package @wundergraph/cosmo-to-apollo-schema receives a total of 73 weekly downloads. As such, @wundergraph/cosmo-to-apollo-schema popularity was classified as not popular.
We found that @wundergraph/cosmo-to-apollo-schema demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.