graphql-api-development

No malware or intentional supply-chain attack behavior is evident. The code is readable educational GraphQL documentation. Security concerns are primarily insecure example design: a hardcoded JWT secret, missing or incomplete authorization, client-controlled identity fields, weak subscription isolation, and insufficient validation and operational controls. These issues warrant remediation before production use but do not indicate malicious intent.