dependency-security
Safeguard articles tagged "dependency-security" — guides, analysis, and best practices for software supply chain and application security.
95 articles
Is react-native-gesture-handler Safe? An npm Security Review
react-native-gesture-handler is a core, actively maintained library, but any native module changes your app's trust and update calculus. Here is the security review.
Package Firewall: Blocking Malicious Dependencies at Inst...
Malicious npm and PyPI packages are published daily. See why a package firewall that blocks at install time stops attacks that post-hoc scanners catch too late.
Supply Chain Threat Detection: What to Watch For and How
A practical look at supply chain threat detection: the signals that reveal a compromised dependency, build system, or update channel, and how to catch them early.
npm audit isn't enough: what it misses
npm audit catches known CVEs and stops there. It misses malicious packages, install scripts, and typosquats -- the threats actually landing in npm today.
CI/CD pipeline dependency security integration coverage
How does Safeguard's pipeline-native dependency security compare to Socket.dev's PR-comment model? A concrete look at coverage, enforcement, and deployment options.
@react-native-clipboard/clipboard: What to Know Before You Read the Clipboard
The @react-native-clipboard/clipboard package is the standard clipboard API for React Native. The security work is less about the package and more about what you copy and paste.
Is the Sharp npm Package Safe? A Security Review
A security review of the sharp npm image-processing library: its native dependency risk, the libwebp CVE that hit it, and how to run npm sharp safely.
npm crypto-js: A Security Review and Safe Usage Guide
The npm crypto-js library is widely used but has a documented cryptographic weakness before 4.2.0. Here is what to check and how to use it safely.
Is the npm mysql Package Safe? A Security Review
A security-focused look at the npm mysql driver: SQL injection risks, prepared statements, connection handling, and why most teams should move to mysql2.
pdfjs-dist on npm: Security Review and Safe Usage
The pdfjs-dist npm package renders PDFs in the browser, but CVE-2024-4367 allowed arbitrary JavaScript execution from a malicious PDF before 4.2.67. Here is what to check.
Ajv npm: A Security Review and Safe Usage Guide
The ajv npm package is the most widely used JSON Schema validator in the Node ecosystem. Here is what you need to know about its security history and safe configuration.
Securing mobile app dependencies: CocoaPods and Gradle
CocoaPods and Gradle power millions of mobile apps. See how orphaned pods, build-script RCE, and dependency confusion put them at real risk today.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.