Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
npm Hack: How Supply Chain Attacks Work and How to Stay Safe
An npm hack rarely means npm itself was breached. It usually means a maintainer account was phished or a package was hijacked. Here is how these attacks unfold and how to defend your builds.
What react-native-get-random-values Does and Why Your App Needs It
The react-native-get-random-values package polyfills crypto.getRandomValues so libraries like uuid work under React Native's Hermes engine. Here is how to install it correctly and use it securely.
@angular-builders/custom-webpack: Extending Angular Builds Without Ejecting
The @angular-builders/custom-webpack package lets you merge custom webpack config into Angular CLI builds. Here is how it works and how to use it without adding risk.
React Diff Viewer: Is the npm Package Still Safe to Use?
The original react-diff-viewer has not shipped a release in years. Here is what that means for security and why most teams should move to the maintained fork.
npm copyfiles: A Security Review and Safe Usage Guide
copyfiles is a tiny cross-platform file-copy CLI that a lot of build scripts rely on. Here is its security profile and how to use the npm copyfiles package carefully.
mobx-react-lite: A Security and Dependency Guide
mobx-react-lite is the lightweight MobX binding for React function components. It is a small, focused dependency, and that shape has real implications for how you keep it safe.
Is react-hot-toast Safe to Use? A Security Review
react-hot-toast is a small, well-maintained React notification library with a clean security record, but the way you render toast content is where risk creeps in.
Is react-native-pager-view Safe? A Security Look at the Package
react-native-pager-view is a widely used swipeable-pager component with a healthy maintenance record. Here is how to assess its supply-chain risk and pin it safely in a React Native app.
Choosing an npm Vulnerability Scanner That Catches Real Threats
npm audit is only the starting point. Here is how an npm vulnerability scanner should handle transitive risk, reachability, install scripts, and lockfile integrity.
web-vitals npm Package: Measuring Core Web Vitals Without Adding Risk
The web vitals npm package from the Chrome team measures LCP, INP, and CLS in the field. Here is how to deploy it without turning performance monitoring into a security or privacy liability.
babel-loader: Keeping Your Babel Toolchain Lean and Patched
The babel-loader npm package bridges webpack and Babel in millions of builds. Here's how to configure it for speed, keep the toolchain patched, and know when you no longer need it.
React Native MMKV: Fast Storage and How to Keep It Secure
React Native MMKV is the fastest key-value store for React Native, but speed does not equal security. Here is how to use it and how to protect the data you put in it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.