Use Dart Sass, published on npm as the sass package. The Sass team announced in October 2020 that LibSass and the packages built on it, including Node Sass, are deprecated. A project still on node-sass is running a stylesheet compiler with no active feature development and a native build step.
What the Sass team said
The announcement, posted on 26 October 2020 on the Sass blog, says the core team concluded that LibSass and the packages built on top of it, including Node Sass, are deprecated. It gives the reason as not enough engineering bandwidth behind LibSass to keep it up to date with the language. The post also explains what the word deprecated is meant to signal to the community.
The Sass install page for Node.js users says you can install Sass with the npm package named sass, which is the pure JavaScript build of Dart Sass. It notes this runs somewhat slower than the other implementations but has the same interface.
Why this belongs in a security review
An old compiler is a long lived build dependency that few people look at. Three things make it worth a ticket:
- It sits in the build chain of every release, so a problem in it reaches all your output.
- A package without active development receives fewer fixes, and advisories can stay open.
- Node Sass is built on LibSass, a native library, so installs typically involve a compiled or prebuilt binary. Check your install logs. Native code adds install scripts and platform specific files. See Node.js native addon security risks for the general pattern.
None of that proves a specific vulnerability exists in your build. It is the sort of dependency that gets stale quietly, and a scan can show how far behind it is.
How to check whether you use it
- Search package.json and the lockfile for node-sass. Use npm ls node-sass or npm explain node-sass to see why it is installed.
- Look for transitive uses. An older UI toolkit, a starter template or a loader may pull it in even if you never listed it.
- Check your build scripts and bundler config for a sass loader that names the implementation explicitly.
- Run the build in a clean checkout to confirm which compiler really runs.
How to migrate
| Step | Action |
|---|---|
| 1 | Install the sass package and remove node-sass |
| 2 | If your loader asks which implementation to use, point it at sass |
| 3 | Build and compare the compiled CSS with the old output |
| 4 | Fix warnings. The Sass team notes that some newer language features, for example treating a slash as a separator, produce deprecation warnings in Dart Sass |
| 5 | Remove leftover native build tooling that only node-sass needed |
| 6 | Commit the lockfile and install with npm ci in CI |
Compare output carefully. A different compiler can format numbers or whitespace differently even when the styling is the same, so use visual checks or a CSS diff on key pages.
If you cannot migrate yet
Sometimes a legacy app is pinned to node-sass by a framework version. In that case, keep a note of the exception, pin the version with a lockfile, and make sure the build job has no secrets it does not need. Plan the upgrade as part of the framework upgrade, and put a date on it so the exception does not become permanent.
What a dependency scanner adds
Deprecation is not always machine readable, so a scanner will not always tell you a package is abandoned. Your own policy can. Decide that deprecated build tooling is reviewed every quarter, and keep an SBOM so you can search it for names like node-sass when an advisory lands.
Safeguard's SBOM and dependency scanning list build tooling like compilers and loaders next to runtime packages, and its policy gates can hold a pull request that adds a package you have banned. You can start with a free scan at gold.safeguard.sh/scan.
Quick check
What is the npm package for Dart Sass?
It is named sass. The Sass install page describes it as the pure JavaScript implementation.
Does deprecated mean node-sass has a known vulnerability?
No. It means the Sass team no longer recommends it. Check advisories separately.
Sources
Last reviewed: 19 October 2026.
