Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
@angular-eslint/schematics: Is the Angular ESLint Setup Package Safe?
A security review of @angular-eslint/schematics: what the package does, its install-time behavior, dependency footprint, and how to adopt it safely in an Angular workspace.
Is react-imask Safe to Use? A Security Guide to the React Input Mask
react-imask has no known CVEs and millions of weekly downloads, but its maintenance signals and how you wire it up matter more than its advisory record.
Is react-spinners Safe? A Supply Chain Look at the npm Package
react-spinners is a popular zero-dependency loading component library for React. Here is an honest look at what it is and how to keep small npm dependencies safe.
Formidable npm: Security Review and Safe Usage of the File-Upload Parser
A security review of the formidable npm package: the file-upload risks, the CVEs assigned against it, and how to configure it so uploads stay safe.
webpack-dev-middleware Security: The CVE-2024-29180 Path Traversal Fix
webpack-dev-middleware serves your bundle in development, but CVE-2024-29180 let a crafted URL read any file off a developer's machine. Here is the fix.
babel-jest: What It Does and How to Keep Your Test Toolchain Safe
babel-jest npm sits in almost every Jest install, quietly transforming your code before tests run. Here is what it does and why test toolchains deserve supply chain attention.
npm request: Why the Package Is Deprecated and What to Use
The npm request package and its request-promise wrapper have been deprecated since February 2020. Here is what that means for your security posture and how to move off them safely.
react-slick: Security and Maintenance Guide for 2025
react-slick is a hugely popular carousel component with no known CVEs, but slowing maintenance and its dependency chain are the risks worth watching before you adopt it.
Archiver npm: A Security Review and Safe-Usage Guide
The archiver npm package builds zip and tar streams cleanly, but the real risks are on the extraction side and in its dependency tree. Here is how to use it safely.
react-md-editor: Using @uiw/react-md-editor Securely
How to use react-md-editor safely: what @uiw/react-md-editor does, the XSS risk in markdown preview, and why rehype-sanitize is not optional for untrusted input.
Joi npm: A Security Review and Safe Usage Guide
The joi npm package is the widely used JavaScript schema validation library. Here is its maintenance status, the @hapi/joi migration, and how to use it safely.
npm commander: Security Review and Safe Usage of the CLI Library
The npm commander package is one of the most-downloaded CLI frameworks for Node. Here is a security-focused review of the library and how to use it safely.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.