
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
A data synchronisation library for JavaScript
npm install bicycle
import BicycleClient from 'bicycle/lib/client';
const client = new BicycleClient();
const subscription = client.subscribe(
{todos: {id: true, title: true, completed: true}},
(result, loaded) => {
// note that if `loaded` is `false`, `result` is a partial result
console.dir(result.todos);
},
);
// to dispose of the subscription:
subscription.unsubscribe();
// Use `update` to trigger mutations on the server. Any relevant subscriptions are updated automatically
client.update('Todo.toggle', {id: todoToToggle.id, checked: !todoToToggle.completed}).done(
() => console.log('updated!'),
);
Queries can also take parameters and have aliases, e.g.
const subscription = client.subscribe(
{'todosById(id: "whatever") as todo': {id: true, title: true, completed: true}},
(result, loaded) => {
console.dir(result.todo);
},
);
import express from 'express';
import BicycleServer from 'bicycle/server';
const app = express();
// other routes etc. here
// define the schema.
// in a real app you'd want to split schema definition across multiple files
const schema = {
objects: [
{
name: 'Root',
fields: {
todoById: {
type: 'Todo',
args: {id: 'string'},
resolve(root, {id}, {user}) {
return getTodo(id);
},
},
todos: {
type: 'Todo[]',
resolve(root, args, {user}) {
return getTodos();
},
},
},
},
{
name: 'Todo',
fields: {
id: 'id',
title: 'string',
completed: 'boolean',
},
mutations: {
addTodo: {
args: {id: 'id', title: 'string', completed: 'boolean'},
resolve({id, title, completed}, {user}) {
return addTodo({id, title, completed});
},
},
toggleAll: {
args: {checked: 'boolean'},
resolve({checked}) {
return toggleAll(checked);
},
},
toggle: {
args: {id: 'id', checked: 'boolean'},
resolve({id, checked}, {user}) {
return toggle(id, checked);
},
},
destroy: {
args: {id: 'id'},
resolve({id}, {user}) {
return destroy(id);
},
},
save: {
args: {id: 'id', title: 'string'},
resolve({id, title}, {user}) {
return setTitle(id, title);
},
},
clearCompleted: {
resolve(args, {user}) {
return clearCompleted();
},
},
},
},
];
};
const bicycle = new BicycleServer(schema);
// createMiddleware takes a function that returns the context given a request
// this allows you to only expose information the user is allowed to see
app.use('/bicycle', bicycle.createMiddleware(req => ({user: req.user})));
app.listen(3000);
Your schema consists of a collection of type definitions. Type definitions can be:
'string', 'number' and 'boolean', but you may wish to add your own)You must always define an ObjectType called 'Root'. This type is a singleton and is the entry point for all queries.
e.g.
export default {
name: 'Root',
fields: {
todoById: {
type: 'Todo',
args: {id: 'string'},
resolve(root, {id}, {user}) {
return getTodo(id);
},
},
todos: {
type: 'Todo[]',
resolve(root, args, {user}) {
return getTodos();
},
},
},
};
Object types have the following properties:
Function) - A function that takes an object of this type and returns a globally unique id, defaults to obj => TypeName + obj.idstring, required) - The name of your Object Typestring) - An optional string that may be useful for generating automated documentationMap<string, Field>) - An object mapping field names onto field definitions.Map<string, Mutation>) - An object mapping field names onto mutation definitions.Fields can have:
typeString, required) - The type of the fieldMap<string, typeString>) - The type of any arguments the field takesstring) - An optional string that may be useful for generating automated documentationFunction) - A function that takes the object, the args (that have been type checked) and the context and returns the value of the field. Defaults to obj => obj.fieldNameMIT
FAQs
A data synchronisation library for JavaScript
The npm package bicycle receives a total of 103 weekly downloads. As such, bicycle popularity was classified as not popular.
We found that bicycle demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.