dependency-security
Safeguard articles tagged "dependency-security" — guides, analysis, and best practices for software supply chain and application security.
95 articles
npm crypto-js: A Security Review and Safe Usage Guide
The npm crypto-js library is widely used but has a documented cryptographic weakness before 4.2.0. Here is what to check and how to use it safely.
Is the npm mysql Package Safe? A Security Review
A security-focused look at the npm mysql driver: SQL injection risks, prepared statements, connection handling, and why most teams should move to mysql2.
pdfjs-dist on npm: Security Review and Safe Usage
The pdfjs-dist npm package renders PDFs in the browser, but CVE-2024-4367 allowed arbitrary JavaScript execution from a malicious PDF before 4.2.67. Here is what to check.
Ajv npm: A Security Review and Safe Usage Guide
The ajv npm package is the most widely used JSON Schema validator in the Node ecosystem. Here is what you need to know about its security history and safe configuration.
npm install axios: A Security Review and Safe Usage Guide
Running npm install axios is safe today, but the version you pin matters. Here is a look at the CVEs that have hit axios and how to use it without leaking credentials.
react-diff-view: Using the Diff Component Securely
react-diff-view renders git unified diffs in React apps. Here is how it works, where the security considerations sit, and how to keep it safe when you render untrusted diffs.
@shopify/react-native-skia: A Security and Safe-Usage Guide
The @shopify/react-native-skia library brings high-performance 2D graphics to React Native. Here is an honest look at its security profile and how to install it safely.
isomorphic-fetch: Security Review and Modern Alternatives
isomorphic-fetch has not shipped a release since 2020, yet thousands of projects still install it. What that means for your security posture, and what to use instead.
Is the npm xlsx Package Safe? A Security Review
A security review of the npm xlsx (SheetJS) package: its prototype pollution and ReDoS CVEs, the npm-versus-CDN patch gap, and how to install it safely.
cross-fetch: Package Health and Security Review
cross-fetch still ships in thousands of lockfiles as a universal fetch polyfill. A review of its one CVE, its node-fetch dependency, and when you no longer need it.
node-html-parser: How to Parse HTML Safely in Node.js
node-html-parser is a fast, dependency-light HTML parser for Node.js. Here is how to use it without opening the door to injection or denial-of-service bugs.
Is Formik on npm Safe? A Security Review
Formik is a widely used React form library. Here is an honest look at its security history, dependency risk, and how to use it safely.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.