
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
A collection of classes, tools, and utilities for creating Relay.js compatible GraphQL servers in dotnet.
Provides the following packages:
| Package | Downloads | NuGet Latest |
|---|---|---|
| GraphQL.Relay |
Add the Nuget package:
$> dotnet add package GraphQL.Relay
Ensure your resolver for GraphQL can resolve:
ConnectionType<>EdgeType<>NodeInterfacePageInfoTypeIf you're using the resolver from MVC (IServiceProvider), that might look like this:
services.AddTransient(typeof(ConnectionType<>));
services.AddTransient(typeof(EdgeType<>));
services.AddTransient<NodeInterface>();
services.AddTransient<PageInfoType>();
Included are a few GraphQL types and helpers for creating Connections, Mutations, and Nodes
QueryGraphTypeA top level Schema query type, which defines the required node root query;
public class StarWarsQuery : QueryGraphType
{
public StarWarsQuery() {
Field<DroidType>(
"hero",
resolve: context => new Droid { DroidId = "1", Name = "R2-D2" }
);
}
}
public class StarWarsSchema : Schema
{
public StarWarsSchema() {
Query = new StarWarsQuery();
}
}
NodeGraphType<TSource, TOut>, NodeGraphType<TSource>, NodeGraphTypeNodeTypes, are ObjectGraphTypes that implement the NodeInterface
and provide a GetById method, which allows Relay (via the node() Query) to refetch nodes when it needs to.
Nodes, also provide a convenient Id() method for defining global id fields, derived from the type Name and Id.
If your underlying type has a name conflict on the field id, the "local" Id will be prefixed with the type name,
e.g. Droid.Id -> droidId
public class Droid
{
public string DroidId { get; set; }
public string Name { get; set; }
}
public class DroidType : NodeGraphType<Droid>
{
public DroidType()
{
Name = "Droid";
Id(d => d.DroidId); // adds an id Field as well as the `Droid` id field
Field<StringGraphType>("name", "The name of the droid.");
}
public override Droid GetById(string droidId) {
return StarWarsData.GetDroidByIdAsync(droidId);
}
}
Relay mutations specify a few constraints on top of the general GraphQL mutations. To accommodate this, there are mutation specific GraphTypes provided.
MutationGraphTypeThe top level mutation type attached to the GraphQL Schema
public class StarWarsMutation : MutationGraphType
{
public StarWarsMutation() {
Mutation<CreateDroidInput, CreateDroidPayload>("createDroid");
Mutation<DeleteDroidInput, DeleteDroidPayload>("deleteDroid");
}
}
public class StarWarsSchema : Schema
{
public StarWarsSchema() {
Query = new StarWarsQuery();
Mutation = new StarWarsMutation();
}
}
MutationInputGraphTypeAn simple base class that defines a clientMutationId field. functionally identical to InputObjectGraphType otherwise
MutationPayloadGraphType<TSource, TOut>, MutationPayloadGraphType<TSource>, MutationPayloadGraphTypeThe output ObjectGraphType containing the mutation payload, functionally similar to an ObjectGraphType with the
addition of requiring a MutateAndGetPayload() method used to resolve the payload from the inputs.
public class CreateDroidPayload : MutationPayloadGraphType<DroidPayload, Task<DroidPayload>>
{
public CreateDroidPayload()
{
Name = "CreateDroidPayload";
Field(
name: "droid",
type: typeof(Droid));
}
public override async Task<DroidPayload> MutateAndGetPayload(MutationInputs inputs)
{
string name = inputs.Get<string>("name");
Droid newDroid = await StarWarsData.CreateDroidAsync(name)
return new DroidPayload {
Droid = newDroid
};
}
}
Luckily GraphQL-dotnet already provides helpful utilities for creating connection fields, on GraphTypes. In addition
included here are a few more helpful methods for creating relay compatible Connections from IEnumerables.
Connection.ToConnection(IEnumerable items, ResolveConnectionContext context)Creates a connection from an existing list of objects.
public class Droid
{
public string DroidId { get; set; }
public string Name { get; set; }
public IEnumerable<Droid> Friends { get; set; }
}
public class DroidType : ObjectGraphType<Droid>
{
public DroidType()
{
Name = "Droid";
Field<StringGraphType>("name", "The name of the droid.");
Connection<DroidType>()
.Name("friends")
.Resolve(context =>
ConnectionUtils.ToConnection(c.Source.Friends, context));
}
}
ConnectionUtils.ToConnection(IEnumerable items, ResolveConnectionContext context, int sliceStartIndex, int totalCount)Similar to the above, but creates a connection with the correct cursors, when you only have a slice of the entire set of items. Windowing the items based on the arguments.
ConnectionUtils.CursorToOffset(string cursor)Convert a connection item cursor to the int index of the item in the set.
ConnectionUtils.OffsetToCursor(int offset)Convert an index offset to a connection cursor.
ResolveConnectionContextExtensions.ToConnection<TSource>(this IResolveConnectionContext context, IQueryable<TSource> items)Creates a connection from an IQueryable.
public class Droid
{
public string DroidId { get; set; }
public string Name { get; set; }
public IQueryable<Droid> Friends { get; set; }
}
public class DroidType : ObjectGraphType<Droid>
{
public DroidType()
{
Name = "Droid";
Field<StringGraphType>("name", "The name of the droid.");
Connection<DroidType>()
.Name("friends")
.Resolve(context => context
.ToConnection(c.Source.Friends));
}
}
FAQs
Package Description
We found that graphql.relay demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.