apollo-router

The fragment is a development-only router configuration and contains no evident malware or intentional supply-chain backdoor. Its main risks are insecure deployment settings: permissive CORS, unrestricted request-header propagation, detailed subgraph error disclosure, and enabled introspection/sandbox. The localhost bindings substantially reduce exposure in the shown configuration, but these settings should not be reused for a publicly reachable production router.