Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
Is the ioredis npm Package Secure? A Practical Review
The ioredis npm package is a solid, well-maintained Redis client, but most real risk lives in how you configure the connection rather than in the library code itself.
Angular CDK: What Ships in @angular/cdk and Keeping It Current
The angular cdk npm package is the behavior layer under Angular Material — overlays, a11y, drag-drop, virtual scroll. Knowing what is inside and how its versioning works keeps upgrades boring.
Open Source Maintainer Succession Planning: A Supply Chain Imperative
When a solo maintainer disappears, entire dependency chains are at risk. How organizations should approach succession planning for critical open source projects.
@angular-eslint/schematics: Is the Angular ESLint Setup Package Safe?
A security review of @angular-eslint/schematics: what the package does, its install-time behavior, dependency footprint, and how to adopt it safely in an Angular workspace.
Is react-imask Safe to Use? A Security Guide to the React Input Mask
react-imask has no known CVEs and millions of weekly downloads, but its maintenance signals and how you wire it up matter more than its advisory record.
Is react-spinners Safe? A Supply Chain Look at the npm Package
react-spinners is a popular zero-dependency loading component library for React. Here is an honest look at what it is and how to keep small npm dependencies safe.
Formidable npm: Security Review and Safe Usage of the File-Upload Parser
A security review of the formidable npm package: the file-upload risks, the CVEs assigned against it, and how to configure it so uploads stay safe.
webpack-dev-middleware Security: The CVE-2024-29180 Path Traversal Fix
webpack-dev-middleware serves your bundle in development, but CVE-2024-29180 let a crafted URL read any file off a developer's machine. Here is the fix.
babel-jest: What It Does and How to Keep Your Test Toolchain Safe
babel-jest npm sits in almost every Jest install, quietly transforming your code before tests run. Here is what it does and why test toolchains deserve supply chain attention.
npm request: Why the Package Is Deprecated and What to Use
The npm request package and its request-promise wrapper have been deprecated since February 2020. Here is what that means for your security posture and how to move off them safely.
react-slick: Security and Maintenance Guide for 2025
react-slick is a hugely popular carousel component with no known CVEs, but slowing maintenance and its dependency chain are the risks worth watching before you adopt it.
Archiver npm: A Security Review and Safe-Usage Guide
The archiver npm package builds zip and tar streams cleanly, but the real risks are on the extraction side and in its dependency tree. Here is how to use it safely.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.