Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
[![Version](https://img.shields.io/npm/v/ar-gql?style=flat&colorA=000000&colorB=000000)](https://www.npmjs.com/package/ar-gql)
ar-gql
version 1A JavaScript/TypeScript package that makes interaction with the Arweave GraphQL endpoint simple and easy.
# npm
npm i ar-gql
# yarn
yarn add ar-gql
Migrating from version v0.x.x to v1.x.x
- Functions are no longer directly imported. You need to import an
ArGqlInterface
object and create instanced from it. See Code Set Up section below- As axios is no longer used internally
e.response
will always be undefined. You can catch regularError
objects with:
e.message // status text e.cause // http status number
in all other Fetch error cases there will be a standard Fetch
TypeError
with a relevent message.
import { arGql, GQLUrls } from 'ar-gql'
//...
const argql = arGql() // default is `https://arweave.net/graphql`.
// you can now use argql similar to as before and it will make requests to the default GQL endpoint
const tx = await argql.tx('DeYQPjoEQLLds7usOMZFJFCe7VyTpodYl6Mok6UP6Z4')
console.log(tx.id) // 'DeYQPjoEQLLds7usOMZFJFCe7VyTpodYl6Mok6UP6Z4'
// you can set up another instance with another endpoint
const goldsky = arGql({ endpointUrl: GQLUrls.goldsky }) // 'https://arweave-search.goldsky.com/graphql'
// and use it at the same time
const edges = await goldsky.tx(someTxid)
//...
run(query, variables?)
The run
function receives as input a required GraphQL query (compatible with the Arweave GraphQL endpoint) and an optional object of GraphQL variables for the query.
The function returns the result of this query with the variables passed in, if any, returned by the Arweave GraphQL endpoint.
all(query, variables?, pageCallback?)
Similar to the run
function, the all
function receives a query and optional variables.
The one key difference is that it returns all possible transactions returned from running this query. As the Arweave GraphQL endpoint is paginated, this returns all the data by traversing through the pages.
Your query must follow the template shown below:
query($cursor: String) {
transactions(
# your query parameters
# standard template below
after: $cursor
first: 100
) {
pageInfo {
hasNextPage
}
edges {
cursor
node {
# what tx data you want to query for:
}
}
}
}
The optional pageCallback
feature is a convenience function to process pages as they are returned. The page results are processed asynchronously, and the function all
returns after all callback functions have completed internally.
N.B When a callback function is used,
all
returns an empty edges array once all page callbacks are complete[]
.
tx(id)
The tx
function recieves as an input a valid Arweave transaction id. The function will then return all metadata information about the transaction that the GraphQL endpoint supports.
fetchTxTag(id, name)
This function will fetch all tags for the supplied transaction. Then, if it finds a tag with the name provided, it will return the tag value. Else, it will return undefined
.
endpointUrl
A read-only property of the GQL endpoint URL of the instance.
FAQs
[![Version](https://img.shields.io/npm/v/ar-gql?style=flat&colorA=000000&colorB=000000)](https://www.npmjs.com/package/ar-gql)
The npm package ar-gql receives a total of 13,035 weekly downloads. As such, ar-gql popularity was classified as popular.
We found that ar-gql demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.