Safeguard
Topic

Open Source

In-depth guides and analysis on open source from the Safeguard engineering team.

252 articles

Open Source

aws-cdk-lib on npm: Security Review and Safe Usage

aws-cdk-lib is the single monolithic package for AWS CDK v2. Its size and its role as infrastructure code make dependency hygiene and construct review the real security work.

Feb 18, 20255 min read
Open Source

npm Commands: A Security-Focused Guide to Safe Usage

The npm commands you run every day have security consequences. Here is a practical npm commands list with the safe way to use each one.

Feb 18, 20255 min read
Open Source

follow-redirects: Known Vulnerabilities and How to Stay Patched

follow-redirects sits under axios in millions of Node apps. A practical guide to its CVE history and how to keep the pinned version current.

Feb 18, 20256 min read
Open Source

react-router-dom and @types/react-router-dom: Versioning Done Right

Installing npm react router dom packages looks trivial until the types break. Here is how react-router-dom versions map to @types packages, and which combinations are wrong.

Feb 14, 20256 min read
Open Source

@babel/plugin-transform-runtime: What It Does and When You Need It

The babel plugin transform runtime deduplicates Babel's injected helpers and keeps polyfills out of the global scope. Here is what it actually changes in your output, and when it earns its place.

Feb 12, 20256 min read
Open Source

rrule npm Package: Recurrence Rules, Health, and Pitfalls

The rrule npm package is the standard way to handle iCalendar recurrence rules in JavaScript — but it carries timezone traps, unbounded-expansion hazards, and a slow maintenance pulse worth knowing before you depend on it.

Feb 11, 20257 min read
Open Source

marked on npm: Security Review and Safe Usage

marked is a fast Markdown parser, but it does not sanitize output and older versions carried a ReDoS bug. Here is how to use marked npm without opening an XSS hole.

Feb 11, 20255 min read
Open Source

Securing Your Vue Project with eslint-plugin-vue

eslint-plugin-vue is the official linter for Vue single-file components. It is not a security scanner, but used well it removes whole classes of bugs that turn into vulnerabilities.

Feb 11, 20255 min read
Open Source

Is the got npm Package Safe? A Security Review of got for Node.js

got is a well-maintained HTTP client, but one redirect-handling CVE and its SSRF-prone defaults are worth knowing before you ship it. Here is the security review.

Feb 11, 20255 min read
Open Source

Is the npm Luxon Package Safe to Use? A Security Review

The npm Luxon package is actively maintained and safe for current use, with one notable historical ReDoS advisory to be aware of. Here is the security picture.

Feb 11, 20255 min read
Open Source

angular-oauth2-oidc: Secure OAuth2 and OIDC in Angular

angular-oauth2-oidc is the most widely used OAuth2 and OpenID Connect client for Angular apps. Here is how to wire it up with PKCE, validate tokens correctly, and avoid the config mistakes that leak sessions.

Feb 11, 20256 min read
Open Source

npm handlebars: A Security Review and Safe Usage Guide

The npm handlebars package is a widely used templating engine with a history of prototype pollution issues. Here is what to know before you depend on it and how to use it safely.

Feb 11, 20256 min read

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.

Open Source (Page 20) — Supply Chain Security Blog | Safeguard