Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
Is uglifyjs-webpack-plugin Safe to Use in 2025? What to Migrate To
uglifyjs-webpack-plugin is deprecated and built on the unmaintained uglify-es. Here is why you should migrate to terser-webpack-plugin and how to do it cleanly.
papaparse npm: Security Review and Best Practices
PapaParse is the go-to CSV parser for JavaScript, but older versions carry a ReDoS flaw. Here is a security review and how to use it safely on untrusted files.
babel-core Security: Known CVEs and How to Stay Patched
babel-core is safe when current, but its dependency chain has carried a code-execution CVE and a ReDoS issue. Here is what to patch and why re-compiling matters.
uuid npm: Security Review and Safe Usage Guide
The uuid npm package is one of the most-installed libraries in the JavaScript ecosystem. Here is an honest look at its security posture and how to use it correctly.
Vetting React Native npm Packages: pager-view, paper, video, config
Before you add react-native-pager-view npm installs to a mobile app, run the same vetting you would for backend code. Here is a practical checklist using four popular packages as case studies.
pdfmake npm: A Security Review and Safe Usage Guide
pdfmake is a popular client and server PDF generator, but its dependency chain and server-side usage carry real risks. Here is a practical security review.
@angular-eslint/builder: What It Is and How to Use It Safely
The @angular-eslint/builder package wires ESLint into the Angular CLI so you can run ng lint. Here's how it fits your build and where the supply-chain risk actually lives.
react-select-async-paginate: A Security Guide
react-select-async-paginate is a thin wrapper over react-select that loads dropdown options page by page. Here is how to use it without inheriting supply chain or data-handling risk.
What Is react-server-dom-webpack? A Security Guide
react-server-dom-webpack is the low-level React Server Components binding meta-frameworks build on. Here is what it does and where the security risks actually live.
Sentry React: A Security Guide
Sentry React gives you error and performance monitoring for React apps, but the SDK also collects data that can leak secrets if you misconfigure it. Here is how to run it safely.
FileSaver.js (file-saver): Package Review and Download Security
The file saver npm package still powers client-side downloads in millions of builds, but it has not shipped a release since 2020. Here is what that means for your dependency tree.
Is npm body-parser Safe? A Security Review and Safe-Usage Guide
A practical look at npm body-parser, the CVE-2024-45590 denial-of-service issue, and how to configure the middleware so it does not become a liability in production.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.