Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
@angular-devkit/build-angular: A Security Guide to the Angular Build Package
@angular-devkit/build-angular is the build toolchain behind the Angular CLI. Most of its security risk is transitive, coming from the build and dev-server dependencies it pulls in.
Is the mammoth npm Package Safe? A DOCX Converter Security Review
The mammoth npm package converts .docx files to HTML, but CVE-2025-11849 showed how a crafted document can read files off your server. Here is what to check.
eslint-plugin-import and import-helpers: Order Your Imports, Catch Mistakes
eslint-plugin-import-helpers gives you fully configurable import ordering; eslint-plugin-import catches the real bugs — unresolved paths, phantom dependencies, cycles. Most codebases want both.
The glob npm Package and CVE-2025-64756: What Happened and How to Fix It
In November 2025 a command-injection flaw in the glob npm CLI lit up scanners across the Node ecosystem. Here is what CVE-2025-64756 actually affects and how to remediate it.
angular.io Security: Keeping Your Angular App Safe in 2025
The docs at angular.io teach safe defaults, but recent CVEs in SSR, the HTTP client, and template sanitization show where the framework still needs your attention.
npm Malware Today: The Current Threats and How to Stay Safe
npm malware today means self-spreading worms, infostealers, and typosquatted packages that run on install. Here is what the current campaigns look like and how to defend your builds.
Is the New Relic npm Package Safe? A Security Review
A security-focused review of the New Relic npm package (newrelic): what it does, how it handles your license key, install-script behavior, and safe-usage tips.
react-native-confirmation-code-field: Building Secure OTP Input
This tiny React Native library gives you a clean OTP entry UI, but a secure one-time-code flow is mostly about what happens around the field, not in it.
Gold Open Source: A Free Directory for the Whole Supply Chain — Now in Your Browser
Gold Open Source is Safeguard's free, no-login directory of security-verified open-source software. It now covers AI models, MCP servers, agent skills, chip manufacturers, and the full MITRE ATT&CK framework — and ships as a Chrome extension.
p-limit: Safe Concurrency Control in Node.js
The p-limit npm package caps how many promises run at once — a one-function library that quietly prevents self-inflicted outages, API bans, and resource exhaustion in Node.js services.
@twotalltotems/react-native-otp-input: A Security Guide
This popular OTP input component for React Native has not shipped an update in years. Here is a security guide to using @twotalltotems/react-native-otp-input, or moving off it.
bcrypt on npm: A Security Review and Safe Usage Guide
The bcrypt npm package is a solid password-hashing choice, but its 72-byte input limit and native build story create footguns worth understanding before you ship.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.