
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
dyson-graphql
Advanced tools
Simplify GraphQL stubbing with Dyson đź”§
Dyson is great at making development simpler when different endpoints provide different responses. However as GraphQL uses the same endpoint for all requests, stubbing requires adding logic and complexity. Especially if you want fast feedback when executing invalid or incomplete GraphQL queries.
dyson-graphql wraps your stubbed data in the graphql
reference implementation for reliable and accurate results.
$ yarn add --dev dyson-graphql
Add a new file to your dyson stubs directory for your GraphQL endpoint, use a schema and stubbed
responses to provide a built resolver to the dyson render key;
const dysonGraphQl = require("dyson-graphql");
const schema = `
type User {
id: Int!
name: String!
}
type Query {
currentUser: User!
}
type Mutation {
createUser(name: String!): User!
updateUser(id: Int!, name: String!): User!
}
`;
module.exports = {
path: "/graphql",
method: "POST",
render: dysonGraphQl(schema)
.query("currentUser", { id: 987, name: "Jane Smart" })
.mutation("createUser", ({ name }) => ({ id: 456, name }))
.mutation("updateUser", ({ id, name }) => {
if (id < 1000) {
return { id, name };
}
throw new Error("Can't update user");
})
.build()
};
Specify your Dyson path and method properties as normal, for most GraphQL endpoints this will
end with /graphql and be a POST method.
Supply your schema to the default export as above, this is necessary so graphql can validate
queries.
Chain query and mutation for each stubbed GraphQL method.
query and mutation methods can have a static response by supplying the responsefaker)Build the resolver by finishing the chain by calling build.
Provide this the built resolver to the Dyson stub as the render property.
FAQs
Simplify GraphQL stubbing with Dyson đź”§
We found that dyson-graphql demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.