Safeguard
Topic

Open Source

In-depth guides and analysis on open source from the Safeguard engineering team.

252 articles

Open Source

react-number-format: A Security Guide for Safe Input Handling

react-number-format is a popular library for formatting numeric and masked inputs. Here is how to use it without opening XSS or validation gaps.

Mar 31, 20265 min read
Open Source

@microsoft/fetch-event-source: Robust SSE Streams in the Browser

The fetch event source library fixes everything the native EventSource API refuses to do: POST bodies, auth headers, and retry logic you actually control.

Mar 30, 20267 min read
Open Source

@angular-builders/jest: Setup and Dependency Security

@angular-builders/jest lets you run ng test with Jest instead of Karma. Here is how it works, the version-alignment rule that trips teams up, and how to keep its dependency tree secure.

Mar 30, 20265 min read
Open Source

serverless-webpack: Secure Bundling for Lambda Functions

serverless-webpack bundles your Lambda handlers with Webpack so each function ships only the code it needs. Here is how it works and the supply chain risks to watch when you adopt it.

Mar 29, 20266 min read
Open Source

Using EJS on npm Safely: CVE-2022-29078 and Beyond

The ejs npm package is a capable template engine that has also been the subject of a serious RCE advisory. Here is how to use it without opening that door.

Mar 29, 20265 min read
Open Source

react-native-asset: A Security Guide to Linking Assets

react-native-asset links fonts, sound files, and other assets into iOS and Android builds. Here is how it works and the supply-chain hygiene it deserves.

Mar 29, 20266 min read
Open Source

core-js 2.6.12: Vulnerabilities, EOL Status, and Upgrading to v3

Searching for core-js 2.6.12 vulnerabilities turns up no CVEs — the finding is the abandoned v2 line itself. What the deprecation actually means and how to migrate to core-js 3 cleanly.

Mar 29, 20266 min read
Open Source

npm dd-trace: Security Review and Safe Usage

The npm dd-trace package is Datadog's Node.js APM tracer. It runs deep in your process, so here is an honest look at its security posture and how to deploy it safely.

Mar 28, 20266 min read
Open Source

aws-cdk-lib on npm: Security Review and Safe Usage

aws-cdk-lib is the single monolithic package for AWS CDK v2. Its size and its role as infrastructure code make dependency hygiene and construct review the real security work.

Mar 28, 20265 min read
Open Source

npm Commands: A Security-Focused Guide to Safe Usage

The npm commands you run every day have security consequences. Here is a practical npm commands list with the safe way to use each one.

Mar 27, 20265 min read
Open Source

follow-redirects: Known Vulnerabilities and How to Stay Patched

follow-redirects sits under axios in millions of Node apps. A practical guide to its CVE history and how to keep the pinned version current.

Mar 27, 20266 min read
Open Source

react-router-dom and @types/react-router-dom: Versioning Done Right

Installing npm react router dom packages looks trivial until the types break. Here is how react-router-dom versions map to @types packages, and which combinations are wrong.

Mar 26, 20266 min read

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.

Open Source (Page 19) — Supply Chain Security Blog | Safeguard