Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
npm run dev: What It Does and How to Run It Safely
npm run dev starts your project's development server via a script in package.json. Here is what actually happens under the hood and the security risks worth knowing.
React Native Cookies: Managing and Securing Session Cookies
A guide to react-native-cookies for reading and writing HTTP cookies in React Native apps, the platform gotchas, and how to keep session cookies secure.
Is the exceljs npm Package Safe? A Security Review
The exceljs npm package is a maintained, popular library for reading and writing Excel files, and it is a reasonable choice, but parsing untrusted spreadsheets carries real risk. Here is the review.
eslint-plugin-react-refresh: What It Does and Why It Matters
A guide to eslint-plugin-react-refresh: what the only-export-components rule enforces, how it relates to the react-refresh webpack plugin, and its security relevance.
Is @vitejs/plugin-react Safe? A Security Review
@vitejs/plugin-react is a build-time dev dependency, so its security story is mostly about supply chain trust and keeping it current rather than runtime exploits.
react-native-compressor: Security and Trust Considerations for Media Compression
react-native-compressor shrinks images, video, and audio on-device before upload. Here is how to vet it, its native footprint, and where the real risks are.
Is the jsPDF npm Package Safe? A Security Review
The jsPDF npm package is widely used for client-side PDF generation, but recent path traversal and ReDoS advisories mean the version you pin matters. Here is what to check.
Angular Compiler Security: What @angular/compiler-cli Handles and How to Keep It Safe
The Angular compiler is more than a build step — it enforces your template sanitization contract, and a 2025 XSS bug proved that assumption can break.
npm Hack: How Supply Chain Attacks Work and How to Stay Safe
An npm hack rarely means npm itself was breached. It usually means a maintainer account was phished or a package was hijacked. Here is how these attacks unfold and how to defend your builds.
pdf-lib npm: A Security Review and Safe Usage Guide
pdf-lib is a popular pure-JavaScript library for creating and editing PDFs, with no known direct vulnerabilities but an inactive maintenance status worth planning around.
What react-native-get-random-values Does and Why Your App Needs It
The react-native-get-random-values package polyfills crypto.getRandomValues so libraries like uuid work under React Native's Hermes engine. Here is how to install it correctly and use it securely.
@angular-builders/custom-webpack: Extending Angular Builds Without Ejecting
The @angular-builders/custom-webpack package lets you merge custom webpack config into Angular CLI builds. Here is how it works and how to use it without adding risk.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.