
Security News
/Research
Popular node-ipc npm Package Infected with Credential Stealer
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
decapi?
decapi is a set of decorators for creating GraphQL APIs in typescript. Write your types and GQL schema at once killing two birds with one stone.

Example below is able to resolve such query
query {
hello(name: "Bob") # will resolve to 'Hello, Bob!'
}
import { SchemaRoot, Query, compileSchema } from 'decapi'
@SchemaRoot()
class SuperSchema {
@Query()
hello(name: string): string {
return `Hello, ${name}!`
}
}
const compiledSchema = compileSchema(SuperSchema)
compiledSchema is a regular GQL executable schema compatible with graphql-js library.
To use it with apollo-server, you'd have to use like this:
import ApolloServer from 'apollo-server'
const server = new ApolloServer({ schema, graphiql: true })
server.listen(3000, () =>
console.log('Graphql API ready on http://localhost:3000/graphql')
)
Although it is encouraged to prefer fastify as it is a bit faster when used with jit.
For now, our query field returned scalar (string). Let's return something more complex. Schema will look like:
mutation {
createProduct(name: "Chair", price: 99.99) {
name
price
isExpensive
}
}
Such query will have a bit more code and here it is:
import {
SchemaRoot,
Query,
ObjectType,
Field,
Mutation,
compileSchema
} from 'decapi'
@ObjectType({ description: 'Simple product object type' })
class Product {
@Field()
name: string
@Field()
price: number
@Field()
isExpensive() {
return this.price > 50
}
}
@SchemaRoot()
class SuperSchema {
@Mutation()
createProduct(name: string, price: number): Product {
const product = new Product()
product.name = name
product.price = price
return product
}
}
const compiledSchema = compileSchema(SuperSchema)
These cases are supported by decapi 2/typescript-rtti:
Promise<SomeType>All other code-first libraries on decorators like typegraphql or typegql require you to write types for these twice. Decapi infers types from typescript without any extra effort on your end.
Even in decapi 2 onward you still can write an explicit type. There are situations when typescript types are not precise enough- for example you want to be explicit about if some number type is Float or Int (GraphQLFloat or GraphQLInt).
Let's modify our Product so it has additional categories field that will return array of strings. For the sake of readability, let's ommit all fields we've defined previously.
@ObjectType()
class Product {
@Field({ type: [String] }) // note we can use any native type like GraphQLString!
categories(): string[] {
return ['Tables', 'Furniture']
}
}
We've added { type: [String] } as @Field options. Type can be anything that is resolvable to GraphQL type
String, Number, Boolean, Date.graphql eg. GraphQLFloat or any type from external graphql library etc@ObjectTyperegisterEnum[String] or [GraphQLFloat] or [MyEnum]Every field function we write can be async and return Promise. Let's say, instead of hard-coding our categories, we want to fetch it from some external API:
@ObjectType()
class Product {
@Field({ type: [String] }) // note we can use any native type like GraphQLString!
async categories(): Promise<string[]> {
const categories = await api.fetchCategories()
return categories.map((cat) => cat.name)
}
}
Firstly, you must install all the new peer dependencies.
This major was a complete rewrite of the reflection of types. From 2.0.0 decapi uses typescript-rtti to infer graphql types from typescript. This should work for all TS types. If you encounter a type which cannot be inferred, please raise an issue.
This means you should always have your decorators without explicit type property.
decapi does reflection through typescript-rtti, so it can always infer a type directly from typescript without having to write them twice. This is what sets it apart, but there are other differences:
There is a much more popular library with the same goals. Differences:
@DuplexObjectType and @DuplexFieldPlease if you enjoy decapi, go and star repo with the proposal-decorators . That's a way to show the TC39 members that you are using decorators and you want to have them in the language.
FAQs

The npm package decapi receives a total of 93 weekly downloads. As such, decapi popularity was classified as not popular.
We found that decapi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.