#graphql

I recently found that because I have asynchronous calls being made in some of my shield rules, it's causing my dataloader batch functions to be called multiple times, when they should only be called once, which leaves me with the N+1 problem across my entire app.

I believe this is due to how dataloader requires that all of the batch function calls occur during the same event loop "tick", and the async calls in my shield rules are preventing this.

Something I think is very important to supply chain security is to have the right information available to make decisions about risk. Existing security tools currently report known vulnerabilities at the tail end of a long disclosure process. We're looking to improve the status quo by providing visibility into more of the supply chain, not just its end products.

Our first step in that effort is to start sharing information that npm is privileged to have due to its position in the publishing pipeline.

Over the next few blog posts I’ll be sharing previews of an API that the npm security team has been developing. Its working title has been the npm Insights API and we’re going to use it to get the information that we have available to us into your hands.

The first part of the API I'd like to show is the PublicationInfo schema. This GraphQL schema allows us to see some important pieces of information about the publication context of a particular package: whether the package was published with 2FA enabled (which is a good sign: they had to provide a second factor during npm publish) and if it was published over the Tor anonymity network (which is a potential red flag).

type PublicationInfo { username: String created: String tor: Boolean tfa: Boolean }

If we wanted to look up the publication information for pg version 7.12.0 the query might look like:

query { package(name: "pg", version: "7.12.0") { publicationInfo { username tor tfa } } }

The result would show us that indeed [email protected] was published with 2FA enabled and that it was not likely published over tor:

{ "data": { "package": { "publicationInfo": { "username": "brianc", "tor": false, "tfa": true } } } }