
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
get-fields
Advanced tools
get-fields was made with the intention of using the same graphql schema but with different fields. Where it is not necessary to create a new schema, but change the fields in the function call.
npm i get-fields
For example, if we want to create a schema to access user data, we can use this function in schema creation:
import { gql } from "@apollo/client";
import getFields from "get-fields";
export function GET_USER(...args) {
const fields = getFields(args); // Returns the selected fields
return gql`
query {
getUser {
${fields} // Adds the selected fields inside the *route*
}
}`;
}
When using the schema, you must pass the fields you want to return separated by commas.
const Profile = () => {
const { data } = useQuery(GET_USER("id", "name", "contact"));
// [...]
};
But if you have to access nested data, you must use nesting object as in the example below:
const Table = () => {
const { data } = useQuery(
GET_SCHEDULE(
"id",
// object usage
{ name: "createdBy", items: ["id", "name", "contact"] },
{ name: "service", items: ["id", "duration", "price"] },
"date",
"status"
)
);
// [...]
};
The nesting object are used to access the fields of the fields. All objects must have two properties:
Example of using the nesting object:
{ name: "createdBy", items: ["id", "name", "contact"]}
The example of using createdBy in graphql schema:
query {
schedules {
date
createdBy {
id
name
contact
}
}
}
Items can also receive nesting object
{ name: "date", items: ["id", { name: "location", items: ["street", "house"] }] }
The above example in graphql schema:
query {
schedules {
date {
id
location {
street
house
}
}
}
}
FAQs
Function to help create and use schemas in apollo client.
We found that get-fields demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.