Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
core-types-graphql
Advanced tools
This package provides conversion functions between core-types
and GraphQL.
You probably don't want to use this package directly, but rather typeconv
which uses this package to convert between TypeScript, JSON Schema and GraphQL.
Other conversion packages:
There are two conversion functions, convertCoreTypesToGraphql
and convertGraphqlToCoreTypes
, both returning a wrapped value, of the type ConversionResult
.
Conversion can be done to GraphQL code using convertCoreTypesToGraphql
, but also to GraphQL AST using convertCoreTypesToGraphqlAst
. The arguments to these are the same.
import { convertCoreTypesToGraphql } from 'core-types-graphql'
let doc; // This core-types document comes from somewhere
const { data: graphQL } = convertCoreTypesToGraphql( doc );
You can provide options as a second argument fn the type:
interface CoreTypesToGraphqlOptions
{
warn?: WarnFunction;
filename?: string;
sourceFilename?: string;
userPackage?: string;
userPackageUrl?: string;
nullTypeName?: string | null;
nameGenerator?: NameGeneratorFunction;
unsupported?: 'ignore' | 'warn' | 'error';
includeComment?: boolean;
}
These options are all optional.
warn
: A function callback to be used for warnings, defaults to console.warn
.filename
The filename to be written to.sourceFilename
: The name of the source file from which the core-types comes.userPackage
: The name of the package using this package.userPackageUrl
: The url to the package using this package.nullTypeName
: Optional custom type used for null.nameGenerator
: A function for generating names.unsupported
: What to do when detecting an unsupported type
ignore
: Ignore (skip) typewarn
: Ignore type, but warn (default)error
: Throw an errorincludeComment
: Includes a header comment about the auto-generated file.true
.The warn
function is of type WarnFunction
from core-types
, meaning it takes a message as string, and an optional second argument of type CoreTypesErrorMeta
, also from core-types
.
The nameGenerator
function is of type NameGeneratorFunction
defined as:
( baseName: string, nameHint: string, test: NameGeneratorTestFunction ) => string;
where NameGeneratorTestFunction
is a test function to check if the generated name is available, on the form:
( name: string ) => boolean;
If this is specified (instead of letting a default name generator be used), an implementation is supposed to generate a name, potentially based on the baseName
and a nameHint
(e.g. an interface name and a property name within that interface), and test this generated name against test
, altering it if necessary until test
returns true
, and then return that string.
import { convertGraphqlToCoreTypes } from 'core-types-graphql'
let graphQL; // This GraphQL string comes from somewhere
const { data: doc } = convertGraphqlToCoreTypes( graphQL );
An optional second argument can be provided on the form
interface GraphqlToCoreTypesOptions
{
warn?: WarnFunction;
unsupported?: 'ignore' | 'warn' | 'error';
}
warn
: The same warn function as in CoreTypesToGraphqlOptionsunsupported
: What to do when detecting an unsupported type
ignore
: Ignore (skip) type (default)warn
: Ignore type, but warnerror
: Throw an errorThis package exports two utility functions; getBreakingChanges
and getDangerousChanges
which both take two GraphQL source code texts (as strings) semantically meaning an "old" and a "new" version of a schema. The functions return a list of breaking/dangerous changes on the type BreakingChange
/DangerousChange
from the graphql
package.
FAQs
core-types ⬌ GraphQL conversion
The npm package core-types-graphql receives a total of 14,063 weekly downloads. As such, core-types-graphql popularity was classified as popular.
We found that core-types-graphql demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.