Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
babel-plugin-inline-import-graphql-ast
Advanced tools
Babel plugin to make .gql/.graphql files importable
Babel plugin allowing import
of .graphql
and .gql
files into .js
and .jsx
files.
As of May 27, 2018, the babel-plugin-inline-import-graphql-ast
package name and the corresponding GitHub repo are deprecated. Please use babel-plugin-import-graphql
(NPM) and the new GitHub repo instead.
babel-plugin-import-graphql@2.x
will remain backwards compatible with the previous package so switching over is safe and easy.
babel-plugin-import-graphql@2.4.2
is identical to 2.4.0
and 2.4.1
of babel-plugin-inline-import-graphql-ast
, with the exception of the package name and README.md
file.
package.json
filedevDependencies
:babel-plugin-inline-import-graphql-ast
-> babel-plugin-import-graphql
.
The first published version of babel-plugin-import-graphql
is 2.4.2
so please make sure your version string matches that. For instance, "babel-plugin-import-graphql": "^2.0.0"
is fine because of the caret.
If you've pinned to a specific version, you'll need to upgrade and pin to at least 2.4.2
or widen your version range to include it.
plugins
array:babel-plugin-inline-import-graphql-ast
(or inline-import-graphql-ast
) -> import-graphql
.
Congratulations, you're all set!
If you enjoy my package go star the new repo or share on Twitter (and follow me for updates)!
$ yarn add -D babel-plugin-inline-import-graphql-ast
In .babelrc
file:
{
"plugins": ["inline-import-graphql-ast"]
}
...
import myQuery from './query.graphql'
...
export default graphql(myQuery)(myComponent)
Replaces graphql-tag/loader
in projects where Webpack is unavailable(i.e. NextJS)
Users of create-react-app that want to avoid ejecting their app can use this package indirectly by using react-app-rewire-inline-import-graphql-ast
.gql
/.graphql
filesThis package was originally intended only for frontend graphql files containing operations, which are to be parsed into GraphQL AST syntax before being inlined into the code. There is now limited support for files containing types and schema definitions. Specifically, only default import syntax is supported, and the entire file will be inlined as raw text. If there are specific features you'd like to see for use with schema-like files, let me know.
.gql
/.graphql
files#import "./fragment.graphql"
.js
/.jsx
filesquery { test }
) and named (query named { test }
) operationsimport anyName from './file.graphql'
note: when multiple operation exist in one file, the first is used as the default export
import { first, second as secondQuery } from './file.graphql'
import * as ops from './file.graphql'
(example usage: graphql(ops.third)
)import firstQuery, * as ops from './file.graphql'
File for examples above:
query first {
test1
}
mutation second {
test2
}
subscription third {
test3
}
ProductsPage.js
import React, { Component } from 'react'
import gql from 'graphql-tag'
import { graphql } from 'react-apollo'
class ProductsPage extends Component {
render() {
if (this.props.data.loading) return <h3>Loading...</h3>
return <div>{`This is my data: ${this.props.data.queryName}`}</div>
}
}
const productsQuery = gql`
query products {
products {
productId
name
description
weight
}
}
`
export default graphql(productsQuery)(ProductsPage)
productFragment.graphql
fragment productFragment on Product {
name
description
weight
}
productsQuery.graphql
#import "./productFragment.graphql"
query products {
products {
productId
...productFragment
}
}
ProductsPage.js
import React, { Component } from 'react'
import { graphql } from 'react-apollo'
import myImportedQuery from './productsQuery.graphql'
class ProductsPage extends Component {
render() {
if (this.props.data.loading) return <h3>Loading...</h3>
return <div>{`This is my data: ${this.props.data.queryName}`}</div>
}
}
export default graphql(myImportedQuery)(ProductsPage)
nodePath
-- Intended primarily for use with react-app-rewire-inline-import-graphql-ast Takes a string like the NODE_PATH
environment variable and is used to allow resolution of absolute paths to your .gql
/.graphql
files. Note this currently is NOT respected for fragment imports. If you already have your NODE_PATH
variable set in your environment, you don't need to set this option.When you import
a .graphql
or .gql
file, it is parsed into a GraphQL AST object by the gql
function from graphql-tag
. This AST object is inserted directly into the importing file, in a variable with the name defined in the import statement.
It is necessary to clear the node_modules/.cache/babel-loader
folder to re-transpile your .gql
/.graphql
files each time one is changed. The recommended method is prepending the relevant script in your package.json
and rerunning the script when you change a GraphQL file:
{
"scripts": {
"start": "rimraf ./node_modules/.cache/babel-loader && node index.js"
}
}
Note you'd need the rimraf dependency installed in this example.
This plugin has problems with babel-generator
before version 6.26.1
, which is included in babel-core
and babel-cli
. Unfortunately, the 6.26.1
update only applied to babel-generator
itself, without bumping the version of the other packages. This means you need a copy of babel-core@6.26.0
or babel-cli@6.26.0
added to your project after February 3rd, 2018. If one of these was added prior to that date, you'll need to remove your node_modules
folder, along with your package-lock.json
or yarn.lock
file, and reinstall your dependencies.
This package started out as a modified version of babel-plugin-inline-import
v2.4.1 (May 27, 2018)
babel-plugin-import-graphql
(see README)FAQs
Babel plugin to make .gql/.graphql files importable
The npm package babel-plugin-inline-import-graphql-ast receives a total of 131 weekly downloads. As such, babel-plugin-inline-import-graphql-ast popularity was classified as not popular.
We found that babel-plugin-inline-import-graphql-ast demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.