dependency-risk
Safeguard articles tagged "dependency-risk" — guides, analysis, and best practices for software supply chain and application security.
22 articles
5 risks of using open source software
Five documented open source risks — from Log4Shell to the XZ Utils backdoor — with real incidents, dates, and CVEs, plus how Safeguard closes the gap.
react-signature-canvas: A Security and Maintenance Review
A security review of react-signature-canvas: what the component does, its inactive maintenance status, the XSS surface to watch, and how to use it safely.
react-native-modal-datetime-picker: Security and Maintenance Guide
The react-native-modal-datetime-picker package is popular and convenient, but its maintenance status and transitive dependencies deserve a look before you commit to it.
angular-ui-router: Security and Maintenance Guide
angular-ui-router is the classic routing library for AngularJS 1.x. The library itself is stable, but the framework it depends on reached end of life, and that is the real risk to weigh.
pdfmake npm: A Security Review and Safe Usage Guide
pdfmake is a popular client and server PDF generator, but its dependency chain and server-side usage carry real risks. Here is a practical security review.
rn-fetch-blob: Maintenance Status, Risks, and Alternatives
The rn-fetch-blob npm package hasn't shipped a release since 2020. Here's what that means for React Native apps still depending on it, and how to migrate to react-native-blob-util.
React File Viewer: Is It Safe, and What Are the Alternatives?
react-file-viewer still gets thousands of weekly downloads despite going years without an update. Here is what the package does, the risks of a dormant dependency, and how to view files more safely.
awesome-typescript-loader: Why to Migrate Off It
awesome-typescript-loader is an unmaintained webpack loader for TypeScript. Here is the security case for migrating to ts-loader and how to do it cleanly.
Abandoned Package Takeover: When Maintainers Walk Away
Abandoned packages are ticking time bombs in the supply chain. When maintainers disappear, attackers can take over package names and push malicious updates to millions of downstream projects.
Abandoned Dependency Risk Study
The Safeguard Research team measured how much abandonment exists in real dependency graphs, how it correlates with risk, and what to do about it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.