Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
React Diff Viewer: Is the npm Package Still Safe to Use?
The original react-diff-viewer has not shipped a release in years. Here is what that means for security and why most teams should move to the maintained fork.
npm copyfiles: A Security Review and Safe Usage Guide
copyfiles is a tiny cross-platform file-copy CLI that a lot of build scripts rely on. Here is its security profile and how to use the npm copyfiles package carefully.
mobx-react-lite: A Security and Dependency Guide
mobx-react-lite is the lightweight MobX binding for React function components. It is a small, focused dependency, and that shape has real implications for how you keep it safe.
Is react-hot-toast Safe to Use? A Security Review
react-hot-toast is a small, well-maintained React notification library with a clean security record, but the way you render toast content is where risk creeps in.
Is react-native-pager-view Safe? A Security Look at the Package
react-native-pager-view is a widely used swipeable-pager component with a healthy maintenance record. Here is how to assess its supply-chain risk and pin it safely in a React Native app.
Choosing an npm Vulnerability Scanner That Catches Real Threats
npm audit is only the starting point. Here is how an npm vulnerability scanner should handle transitive risk, reachability, install scripts, and lockfile integrity.
web-vitals npm Package: Measuring Core Web Vitals Without Adding Risk
The web vitals npm package from the Chrome team measures LCP, INP, and CLS in the field. Here is how to deploy it without turning performance monitoring into a security or privacy liability.
babel-loader: Keeping Your Babel Toolchain Lean and Patched
The babel-loader npm package bridges webpack and Babel in millions of builds. Here's how to configure it for speed, keep the toolchain patched, and know when you no longer need it.
React Native MMKV: Fast Storage and How to Keep It Secure
React Native MMKV is the fastest key-value store for React Native, but speed does not equal security. Here is how to use it and how to protect the data you put in it.
universal-cookie: Package Review and Cookie Security Basics
A review of the universal cookie npm package: what it does in isomorphic apps, the advisory it inherited through its cookie dependency, and the cookie security flags that matter more than the library.
npm ws Security: Fixing the CVE-2024-37890 WebSocket DoS
The npm ws package powers most Node WebSocket servers. CVE-2024-37890 let a flood of request headers crash it. Here is how the flaw works and how to patch.
jest-environment-jsdom: Setup, Gotchas, and Supply Chain Notes
Setting up npm jest-environment-jsdom correctly, why it stopped shipping with Jest, and what its jsdom dependency tree means for your test toolchain's security.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.