Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
react-native-flash-message: A Security Guide
The react-native-flash-message package is a popular but no-longer-maintained notification library. Here is what its inactive status means for your app's security.
Multer on npm: Security Review and the 2025 DoS Fixes
Multer had a run of denial-of-service advisories through 2025. Here is what each one was, which version fixes them, and how to use the npm package safely.
jose npm: A Security Review and Safe Usage Guide
The jose npm package is a well-regarded library for JWT, JWS, and JWE across JavaScript runtimes. It gives you the right primitives; using them securely still comes down to how you verify tokens.
react-test-renderer: Deprecation, Risks, and What to Use Instead
react-test-renderer is now deprecated and unmaintained as of React 19. Here is what that means for your test suite and how to migrate off it safely.
react-hook-form npm: A Security Review and Safe Usage Guide
The react-hook-form npm package is a dependency-free form library with a clean security record. The risk is not the library itself but how you validate and handle the data it collects.
fast-xml-parser on npm: Security Review and Safe Usage
fast-xml-parser is one of the most-downloaded XML parsers on npm. Here is its security history, the CVEs that mattered, and how to use it safely.
superagent npm: Security Review and Safe HTTP Requests
SuperAgent is a mature HTTP client for Node.js, but old versions carry prototype pollution and information-exposure flaws. Here is a practical security review.
react-native-video-processing: Status, Risks, and Alternatives
A security-minded look at react-native-video-processing: what the library does, its maintenance status, the native dependency risk, and what to use instead.
form-data npm Package: Usage, Health, and Security Review
The form-data npm package builds multipart request bodies for half the Node.js ecosystem — and its 2025 predictable-boundary CVE showed how a one-line randomness choice becomes an injection primitive.
Is the ioredis npm Package Secure? A Practical Review
The ioredis npm package is a solid, well-maintained Redis client, but most real risk lives in how you configure the connection rather than in the library code itself.
Angular CDK: What Ships in @angular/cdk and Keeping It Current
The angular cdk npm package is the behavior layer under Angular Material — overlays, a11y, drag-drop, virtual scroll. Knowing what is inside and how its versioning works keeps upgrades boring.
Open Source Maintainer Succession Planning: A Supply Chain Imperative
When a solo maintainer disappears, entire dependency chains are at risk. How organizations should approach succession planning for critical open source projects.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.