dependency-security
Safeguard articles tagged "dependency-security" — guides, analysis, and best practices for software supply chain and application security.
95 articles
Monorepo vs Polyrepo: How Architecture Choices Shape Supp...
Monorepos and polyrepos don't just shape build times — they shape blast radius, patch speed, and dependency visibility. Here's how each affects supply chain risk.
Hallucinated Dependencies: How AI Models Invent Package N...
AI coding assistants regularly invent package names that don't exist — and attackers are registering them first. Here's how slopsquatting works and how to defend against it.
Post-Install Scripts: The Overlooked Execution Point Atta...
Postinstall scripts run automatically on `npm install` with full user privileges—no review required. Here's how attackers exploit them, from ua-parser-js to Shai-Hulud.
Protestware and Sabotage: When Maintainers Turn Against T...
Protestware turns trusted maintainers into insider threats. See how node-ipc, colors.js, and left-pad became sabotage vectors, and how Safeguard catches the next one.
Is Node.js Safe? A Security Guide for Production Apps
Is Node.js safe to run in production? The runtime itself is well maintained and secure by modern standards. The real risk lives in the dependency tree and how you configure the app around it.
Comparing Node.js frameworks for security: Express, Fastify, NestJS
Express, Fastify, and NestJS compared on real CVE history, default security posture, and dependency risk — plus how to close the gaps framework choice alone can't.
Joi npm: A Security Review and Safe Usage Guide
The joi npm package is the widely used JavaScript schema validation library. Here is its maintenance status, the @hapi/joi migration, and how to use it safely.
npm commander: Security Review and Safe Usage of the CLI Library
The npm commander package is one of the most-downloaded CLI frameworks for Node. Here is a security-focused review of the library and how to use it safely.
Using Python libraries for secure network communication
A look at requests, urllib3, cryptography, and paramiko: real CVEs (Terrapin, header leaks), insecure defaults, and how to pin them safely.
React Fast Marquee: A Security and Maintenance Guide
React Fast Marquee is a lightweight scrolling-marquee component for React. Here is an honest look at its risk profile, maintenance status, and how to use it safely.
react-scripts After Create React App: A Security Guide
With Create React App deprecated, react-scripts is now in maintenance mode. Here is what that means for the security of projects still depending on it.
prop-types npm: Security Review and Safe Usage
The prop-types npm package is a runtime type checker React split out years ago. React 19 stopped honoring propTypes internally, which changes when and why you should still depend on it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.