Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
core-js on npm: Security Review and Safe Usage
A security and sustainability review of core-js on npm: the postinstall history, the maintainer funding crisis, and how to keep this near-universal dependency safe.
connected-react-router: A Security Guide for an Inactive Package
connected-react-router is popular but no longer actively maintained and has no official React 18 support. Here is the risk that creates and how to move off it safely.
react-syntax-highlighter: Rendering Code Safely in React
react-syntax-highlighter is the go-to library for showing code blocks in React apps. Here is how to use it and how to avoid the XSS traps around rendering untrusted code.
npm uninstall package: How to Safely Remove Dependencies
How the npm uninstall package command works, what it leaves behind, and how to confirm a removed dependency is actually gone from your tree and your risk surface.
minimatch npm: Security Review and Safe Usage
The minimatch npm package powers glob matching across the JavaScript ecosystem, and a ReDoS flaw made older versions a denial-of-service risk. Here is what to know and how to stay safe.
Lodash on npm: Prototype Pollution Risks and the Safe Version
The lodash npm package is everywhere, and older versions carry real prototype pollution CVEs. Here are the fixed versions and how to check what your tree resolves to.
npm run: How Scripts Work and How to Use Them Safely
npm run executes the scripts defined in your package.json. Here is how it resolves commands, the lifecycle hooks that run automatically, and the supply-chain risks to watch.
chokidar on npm: A Security Review of the File-Watching Library
chokidar is the file-watching library behind most of the Node.js tooling ecosystem, and version 4 cut its dependency count from 13 to 1. Here is what that means for your supply chain risk.
npm underscore Security Review: Is It Safe to Use in 2025?
A security review of the npm underscore package, the code-injection CVE in its template function, and whether you still need it in a modern JavaScript stack.
Software Heritage and the Case for Source Code Preservation
Software Heritage archives the world's source code. Here is why that matters for supply chain security, reproducibility, and long-term software integrity.
Open Source Funding, Sustainability, and Security
The software industry runs on open source maintained by unpaid volunteers. Until we fix the funding problem, we can't fix the security problem.
The Open Source Maintainer Burnout Crisis and Its Security Consequences
Burned-out maintainers abandon projects, accept risky PRs without review, and hand off keys to strangers. The burnout crisis is a supply chain security crisis.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.