
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Well-known Apollo's graphql-tag library hasn't been updated for a long time, and there has been several PRs got stuck there.
The current library solves one common weakness of graphql-tag: it allows to refer fragments multiple times and have them de-duplicated in the query.
Imagine we have a common FragDate fragment which two other fragments, FragCreated and FragUpdated, depend on. Then, with the default graphql-tag library, using of both FragCreated and FragUpdated in the same query won't be possible since FragDate would be included twice, and we'd get a server-side error.
Here comes graphql-tag: it de-duplicates fragments each time they're used.
import gql from "gql-dedup";
const FragDate = gql`
fragment FragDate on User {
day
month
year
}
`;
const FragCreated = gql`
fragment FragCreated on User {
created {
...FragDate
}
}
${FragDate}
`;
const FragUpdated = gql`
fragment FragUpdated on User {
updated {
...FragDate
}
}
${FragDate}
`;
const Query = gql`
query User {
viewer {
...FragCreated
...FragUpdated
}
}
${FragCreated}
${FragUpdated}
`;
Result (notice that FragDate is included only once):
query User {
viewer {
...FragCreated
...FragUpdated
}
}
fragment FragCreated on User {
created {
...FragDate
}
}
fragment FragDate on User {
day
month
year
}
fragment FragUpdated on User {
updated {
...FragDate
}
}
FAQs
A graphql-tag improvement library which de-duplicates fragments.
The npm package gql-dedup receives a total of 2,970 weekly downloads. As such, gql-dedup popularity was classified as popular.
We found that gql-dedup demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.