Safeguard
Topic

Open Source

In-depth guides and analysis on open source from the Safeguard engineering team.

252 articles

Open Source

Is the Busboy npm Package Safe? A Security Review

The busboy npm package parses multipart form data in Node.js. Here is its current security status, the dicer history that once bit it, and how to use it safely.

May 27, 20255 min read
Open Source

Is the npm mysql Package Safe? A Security Review

A security-focused look at the npm mysql driver: SQL injection risks, prepared statements, connection handling, and why most teams should move to mysql2.

May 27, 20256 min read
Open Source

react-native-app-auth: Secure OAuth and OpenID Connect for React Native

react-native-app-auth bridges the native AppAuth SDKs so your React Native app gets PKCE and RFC 8252 flows for free. Here is how to wire it up safely, including Azure AD.

May 27, 20255 min read
Open Source

react-native-webview Security: Hardening WebViews in Mobile Apps

The react-native-webview component gives your app a browser inside the app, and that power is exactly why it needs careful configuration to avoid opening a hole in your mobile security.

May 27, 20255 min read
Open Source

Is workbox-webpack-plugin Safe? A Security Guide

workbox-webpack-plugin generates service workers for your PWA at build time. Here is what its security profile looks like and how to keep the caching layer it creates from becoming a liability.

May 27, 20256 min read
Open Source

react-native-screens: A Security Guide for React Native Apps

react-native-screens is a low-level navigation dependency most developers never install directly. Here is what it does and how to think about its security in a mobile app.

May 27, 20256 min read
Open Source

Is the npm he Package Safe to Use? A Security Review

The npm he package is a tiny, dependency-free HTML entity encoder and decoder. Here is what it does, whether it is safe, and where developers misuse it.

May 27, 20256 min read
Open Source

react-native-root-toast: A Security Guide

react-native-root-toast renders toast messages above your React Native app. The security questions are about what text you show, which peer versions you pin, and how you audit the dependency.

May 27, 20255 min read
Open Source

Docker and npm: How to Build Secure Node.js Images

Combining Docker and npm the naive way ships a bloated, vulnerable image. Here is how to build lean, reproducible, and secure Node.js containers.

May 22, 20256 min read
Open Source

npm install --legacy-peer-deps: What It Does and When It Bites

npm install --legacy-peer-deps tells npm to skip peer dependency resolution entirely, the way npm 4-6 did. That unblocks a broken install today and quietly plants runtime and security problems for later.

May 22, 20257 min read
Open Source

Is react-device-detect Safe? A Security Review of the npm Package

A look at react-device-detect, what the library does with user-agent parsing, and the supply-chain and privacy considerations before you add it to a React app.

May 22, 20255 min read
Open Source

pdfjs-dist on npm: Security Review and Safe Usage

The pdfjs-dist npm package renders PDFs in the browser, but CVE-2024-4367 allowed arbitrary JavaScript execution from a malicious PDF before 4.2.67. Here is what to check.

May 22, 20255 min read

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.

Open Source (Page 12) — Supply Chain Security Blog | Safeguard