Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
graphql-ruby-operation-store-plugin
Advanced tools
Webpack plugin to automatically sync persisted queries
This is a WIP and it's not ready for production use
A webpack plugin to help sync persisted queries during webpack's build lifecycle, so everytime you edit a .graphql
file in the app, it syncs the latest queries to your development server.
# with NPM
npm install webpack-virtual-modules --save-dev
# with Yarn
yarn add webpack-virtual-modules --dev
// In your Webpack configuration
const OperationStorePlugin = require('graphql-ruby-operation-store-plugin');
const VirtualModulesPlugin = require('webpack-virtual-modules');
const virtualModules = new VirtualModulesPlugin();
plugins = [
virtualModules, // FIXME: Must be a better way of doing this
new OperationStorePlugin(virtualModules, graphqlRubySyncOptions)
]
During the build process, it generates a virtual module that can be included.
import OperationStore from 'graphql-ruby-operation-store';
Whenever a .graphql
file changes, it will sync the queries again and generate a new operation store module. Since this avoids writing the module to disk, it avoids the complications triggering infinite loops and telling JS loaders to avoid linting or transpiling the file.
It also generates a JSON file with all the operations and digests in the project root, so you can check them in for reference.
For graphql-pro
users who are using persisted queries with a frontend built by Webpack, the typical setup is to allow string queries in development and then sync the queries to the production backend in some build step.
There are a couple of issues with this approach.
The operation-store.js
has to be consumed by the webpack build process. Since these queries are to be synced with production, it probably has to be done in a process that can safeguard production secrets, such as a CI process right before deploy (you probably don't want to sync to production on every build).
If you combine this with running string queries in development, this means that the last pre-production CI run might be the first time invoking GraphQL Pro's sync script.
This can result in failures from bad naming of operations etc that might not be flagged out. Ideally we'd like a way where we can run persisted queries in both development and production.
In order to make your client work with the server, the staging / QA instance of your GraphQL server must have all the persisted queries operations seeded. This means seeding them over from production? In an active app, the DB might grow to be too large for seeding. If we only care about the latest queries for a client, do we run the sync task when deploying staging?That couples the deploy of one app to another one.
As a compromise, it should be ok to have the latest queries, automatically seeded during the deploy process of the server.
virtual-modules
dependency. Now you have to explicitly set it up.FAQs
Webpack plugin to automatically sync persisted queries
The npm package graphql-ruby-operation-store-plugin receives a total of 2,234 weekly downloads. As such, graphql-ruby-operation-store-plugin popularity was classified as popular.
We found that graphql-ruby-operation-store-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.