
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
graphiql
Advanced tools
Security Notice: All versions of
graphiql<1.4.3are vulnerable to an XSS attack in cases where the GraphQL server to which the GraphiQL web app connects is not trusted. Learn more in our security advisory.
/ˈɡrafək(ə)l/ A graphical interactive in-browser GraphQL IDE. Try the live demo.
localStoragemain branch:
CDN (ESM-based) - A single HTML file using JavaScript modules from http URLs and a <script> tagWebpack - A starter for WebpackCreate React App - An example
using Create React AppParcel - An example using
ParcelUse the modern, ESM-based CDN approach. See the ESM-based example for setup details.
[!WARNING]
The UMD CDN build is deprecated and will be removed in a future major release of GraphiQL. Please migrate to the ESM-based example.
The graphiql package can be installed using your favorite package manager. You
also need to have react,react-dom and graphql installed which are peer
dependencies of graphiql.
npm install graphiql react react-dom graphql
The package exports a bunch of React components:
GraphiQLProvider components renders multiple context providers that
encapsulate all state managementGraphiQLInterface component renders the UI that makes up GraphiQLGraphiQL component is a combination of both the above componentsThere is a single prop that is required for the GraphiQL component called
fetcher. A fetcher is a function that performs a request to a GraphQL API. It
may return a Promise for queries or mutations, but also an Observable or an
AsyncIterable in order to handle subscriptions or multipart responses.
An easy way to get create such a function is the
createGraphiQLFetcher
method exported from the @graphiql/toolkit package. If you want to implement
your own fetcher function, you can use the Fetcher type from
@graphiql/toolkit to make sure the signature matches what GraphiQL expects.
The following is everything you need to render GraphiQL in your React application:
import { createGraphiQLFetcher } from '@graphiql/toolkit';
import { GraphiQL } from 'graphiql';
import { createRoot } from 'react-dom/client';
import 'graphiql/style.css';
const fetcher = createGraphiQLFetcher({ url: 'https://my.backend/graphql' });
const root = createRoot(document.getElementById('root'));
root.render(<GraphiQL fetcher={fetcher} />);
GraphiQL supports customization in UI and behavior by accepting React props and children.
For props documentation, see the API Docs
Parts of the UI can be customized by passing children to the GraphiQL or the
GraphiQLInterface component.
<GraphiQL.Logo>: Replace the GraphiQL logo with your own.
<GraphiQL.Toolbar>: Add a custom toolbar below the execution button. Pass
the empty <GraphiQL.Toolbar /> if an empty toolbar is desired. Use the
components provided by @graphiql/react to create toolbar buttons with proper
styles.
<GraphiQL.Footer>: Add a custom footer shown below the response editor.
Starting with graphiql@2 there exists a simple plugin API that allows you to
build your own custom tools right into GraphiQL.
There are two built-in plugins that come with GraphiQL: The documentation explorer and the query history. Both can be toggled using icons in the sidebar on the left side of the screen. When opened, they appear next to the sidebar in a resizable portion of the screen.
To define your own plugin, all you need is a JavaScript object with three properties:
title: A unique title for the plugin (this will show up in a tooltip when
hovering over the sidebar icon)icon: A React component that renders an icon which will be included in the
sidebarcontent: A React component that renders the plugin contents which will be
shown next to the sidebar when opening the pluginYou can pass a list of plugin objects to the GraphiQL component using the
plugins prop. You can also control the visibility state of plugins using the
visiblePlugin prop and react to changes of the plugin visibility state using
the onTogglePluginVisibility prop.
Inside the component you pass to content you can interact with the GraphiQL
state using the hooks provided by @graphiql/react. For example, check out
how you can integrate the OneGraph Explorer in GraphiQL using the plugin API in
the plugin package in this repo.
The GraphiQL interface uses CSS variables for theming, in particular for colors.
Check out the root.css file for the
available variables.
Overriding these variables is the only officially supported way of customizing the appearance of GraphiQL. Starting from version 2, class names are no longer be considered stable and might change between minor or patch version updates.
The colors inside the editor can also be altered using
CodeMirror editor themes. You can use
the editorTheme prop to pass in the name of the theme. The CSS for the theme
has to be loaded for the theme prop to work.
// In your document head:
<link
rel="stylesheet"
href="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.23.0/theme/solarized.css"
/>
// When rendering GraphiQL:
<GraphiQL editorTheme="solarized light" />
You can also create your own theme in CSS. As a reference, the default
graphiql theme definition can be found
here.
When multiple GraphiQL instances run on the same origin—such as in different apps or
environments—they can conflict by reading from and writing to the same localStorage keys. To
prevent this, you can provide a custom storage object that prefixes all keys with a unique
namespace, isolating each instance’s state and avoiding collisions.
import type { FC } from 'react';
import { GraphiQL } from 'graphiql';
import { createGraphiQLFetcher } from '@graphiql/toolkit';
const fetcher = createGraphiQLFetcher({ url: 'https://my.backend/graphql' });
const NAMESPACE = 'my-namespace';
const storage: typeof localStorage = {
...localStorage,
getItem(key) {
return localStorage.getItem(`${NAMESPACE}:${key}`);
},
setItem(key, value) {
return localStorage.setItem(`${NAMESPACE}:${key}`, value);
},
removeItem(key) {
return localStorage.removeItem(`${NAMESPACE}:${key}`);
},
};
export const App: FC = () => {
return <GraphiQL fetcher={fetcher} storage={myStorage} />;
};
Apollo Server is a community-driven, open-source GraphQL server that works with any GraphQL schema. It provides a simple setup for creating a GraphQL server and includes features like schema stitching, caching, and performance monitoring. Unlike GraphiQL, which is an IDE, Apollo Server focuses on the server-side implementation of GraphQL.
GraphQL Playground is another in-browser IDE for GraphQL, similar to GraphiQL. It offers a more modern interface and additional features like query history, configuration settings, and multiple tabs. It is often used as a replacement for GraphiQL in many projects.
Altair is a feature-rich GraphQL client that provides a clean and modern interface for testing GraphQL queries and mutations. It includes features like query history, variable management, and file uploads. Altair is similar to GraphiQL but offers more advanced features and a more polished user experience.
FAQs
An graphical interactive in-browser GraphQL IDE.
The npm package graphiql receives a total of 701,973 weekly downloads. As such, graphiql popularity was classified as popular.
We found that graphiql demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 12 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.