Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
npm package signature verification: the 2026 rollout state
Every package on npm is signed by the registry, but the actual posture of install-time signature verification across real-world tooling is patchier than the headline suggests. This is where npm audit signatures and downstream verifiers stand in 2026.
A practical framework for assessing single-maintainer project risk
Truck factor is the headline metric, but it is not enough. Here is a working framework for evaluating single-maintainer projects in your dependency tree without panicking or being naive.
Maintainer burnout is a supply-chain risk: lessons from xz-utils
The xz-utils backdoor was made possible because a single exhausted maintainer accepted help from a patient and well-resourced stranger. Sustaining critical maintainers is now a security problem, not just a moral one.
The bootloader supply chain: what an OS vendor controls versus inherits
Between firmware and the kernel sits a thin layer of code that almost no one audits and almost everyone trusts. Understanding the supply chain behind shim, GRUB, and u-boot is the difference between owning your boot path and renting it.
Vitest on npm: A Security Review Before You Add It
Vitest is a fast Vite-native test runner, but its API and browser-mode servers have a real security footprint. Here is what to check before adding vitest from npm.
How to Check for npm Vulnerabilities (and Actually Fix Them)
npm check vulnerabilities the right way: what npm audit tells you, where it misleads, and how to turn a wall of advisories into a short list of things worth fixing.
How to Secure webpack-dev-server Against Source Code Theft
webpack-dev-server is a local development server, not a production one, and two 2025 CVEs showed exactly why that distinction matters. Here is how it leaks and how to lock it down.
react-native-inappbrowser-reborn: A Security Review of the In-App Browser Package
A practitioner's security look at react-native-inappbrowser-reborn: what it does, where the risk lives, and how to vet it and siblings like react-native-wifi-reborn.
yup npm: A Security Review of the Schema Validation Library
The yup npm package is a mature, actively maintained schema validation library, and it is safe to use, but validation belongs on the server and yup schemas need to be written defensively. Here is the review.
react-sortable-hoc: Security and Maintenance Status Review
react-sortable-hoc is no longer actively maintained and leans on the soon-to-be-removed findDOMNode API. Here's what that means for your risk and what to migrate to.
webpack-merge: What It Does and How to Use It Securely
webpack-merge cleanly combines webpack configs, but its low release cadence and function-executing merge behavior deserve a security-minded look.
@react-native-community/geolocation: Is It Safe and Maintained?
@react-native-community/geolocation is the actively maintained official location module for React Native, and the biggest security question with it is privacy, not code vulnerabilities.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.