Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
universal-cookie: Package Review and Cookie Security Basics
A review of the universal cookie npm package: what it does in isomorphic apps, the advisory it inherited through its cookie dependency, and the cookie security flags that matter more than the library.
npm ws Security: Fixing the CVE-2024-37890 WebSocket DoS
The npm ws package powers most Node WebSocket servers. CVE-2024-37890 let a flood of request headers crash it. Here is how the flaw works and how to patch.
jest-environment-jsdom: Setup, Gotchas, and Supply Chain Notes
Setting up npm jest-environment-jsdom correctly, why it stopped shipping with Jest, and what its jsdom dependency tree means for your test toolchain's security.
react-native-flash-message: A Security Guide
The react-native-flash-message package is a popular but no-longer-maintained notification library. Here is what its inactive status means for your app's security.
Multer on npm: Security Review and the 2025 DoS Fixes
Multer had a run of denial-of-service advisories through 2025. Here is what each one was, which version fixes them, and how to use the npm package safely.
jose npm: A Security Review and Safe Usage Guide
The jose npm package is a well-regarded library for JWT, JWS, and JWE across JavaScript runtimes. It gives you the right primitives; using them securely still comes down to how you verify tokens.
react-test-renderer: Deprecation, Risks, and What to Use Instead
react-test-renderer is now deprecated and unmaintained as of React 19. Here is what that means for your test suite and how to migrate off it safely.
react-hook-form npm: A Security Review and Safe Usage Guide
The react-hook-form npm package is a dependency-free form library with a clean security record. The risk is not the library itself but how you validate and handle the data it collects.
fast-xml-parser on npm: Security Review and Safe Usage
fast-xml-parser is one of the most-downloaded XML parsers on npm. Here is its security history, the CVEs that mattered, and how to use it safely.
superagent npm: Security Review and Safe HTTP Requests
SuperAgent is a mature HTTP client for Node.js, but old versions carry prototype pollution and information-exposure flaws. Here is a practical security review.
react-native-video-processing: Status, Risks, and Alternatives
A security-minded look at react-native-video-processing: what the library does, its maintenance status, the native dependency risk, and what to use instead.
form-data npm Package: Usage, Health, and Security Review
The form-data npm package builds multipart request bodies for half the Node.js ecosystem — and its 2025 predictable-boundary CVE showed how a one-line randomness choice becomes an injection primitive.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.