
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
graphbase-core
Advanced tools
Graphbase-core is a library which generates backend resolvers based on GraphQL schema provided by the user.
Graphbase-core is a library which generates backend resolvers based on GraphQL schema provided by the user.
If you would like to know how you can use it, please check this README file.
To install graphbase-core library you can run:
npm i --save-dev graphbase-core
The only thing that the user should create and provide to the graphbase-core library is the input schema file.
The example schema could look like this:
directive @model on OBJECT
type Person @model {
firstName: String!
lastName: String!
age: Int!
height: Float
hasDrivingLicenses: Boolean
interests: [Interests!]!
}
type Interests @model {
name: String!
description: String
}
type Query {
version: String
}
type Mutation {
version: String
}
schema {
query: Query
mutation: Mutation
}
Please remember that schema must contain schema type with any Query and Mutation type.
For all types marked with directive @models graphbase-core library will generate:
Default command:
npx graphbase-core
If you want to specify input schema path you can run:
npx graphbase-core --inputSchema pathToInputSchema
After running one of these commands graphbase-core library will generate all models and resolvers required to run your backend!
Before running your backend you should configure your typescript build and provide database URL in .env file.
To build your project properly you should add two lines to your tsconfig.json:
"compilerOptions": {
"rootDir": "./src",
"outDir": "./lib"
}
The last configuration step is creating a .env file with a connection link to your mongoDb database. Example .env file:
DATABASE_URL=mongodb+srv://userName:password@cluster0.nv1zf.mongodb.net/collection-name?retryWrites=true&w=majority
If you follow all configuration steps you can add to your package.json script like this below and run it:
"scripts": {
"start": "tsc --build tsconfig.json && dotenv -e .env stucco"
}
After that,the backend is running on port 8080 and you can execute all CRUD operations to your database!
If you have any problem during using graphbase-core library please create an issue or contact me directly:
MIT 🕊
FAQs
Graphbase-core is a library which generates backend resolvers based on GraphQL schema provided by the user.
The npm package graphbase-core receives a total of 0 weekly downloads. As such, graphbase-core popularity was classified as not popular.
We found that graphbase-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.