discovered
graphql.vscode-graphql-syntax is identified in the SafeDep analysis "Malicious npm Packages using Burp Collaborator for Dependency Confusion Attack". Multiple npm packages impersonating popular package names were published to the npm registry including by a Snyk researcher apparently targeting internal packages at Cursor AI.