javascript
Safeguard articles tagged "javascript" — guides, analysis, and best practices for software supply chain and application security.
93 articles
JavaScript Security: The Common Pitfalls That Keep Burning Teams
The recurring JavaScript security mistakes that show up in real breaches — unsafe deserialization, injection sinks, prototype pollution, and trusting client input — each with vulnerable and fixed code.
regenerator-runtime: What It Is and Whether to Worry
regenerator-runtime shows up in thousands of dependency trees, usually transitively. Here is what it does, why it is there, and how to think about its risk.
How to Build a Secure npm Package (2026)
A practical checklist for shipping an npm package that resists supply chain attacks: provenance, granular tokens, minimal published files, no install scripts, and ReDoS-safe code.
Is Lodash Safe? A 2026 Security Guide
Lodash powers a huge slice of the JavaScript ecosystem — and a string of prototype pollution and injection CVEs have made 'is lodash safe' a real question. Here is the honest answer for 2026.
Node.js Security Best Practices for 2026
A practical, runtime-aware checklist for hardening Node.js services in 2026 — from the built-in permission model and secure defaults to dependency risk, secrets, and reachability-based triage.
WebAssembly Security Explained (2026)
WebAssembly runs untrusted code in a memory-isolated sandbox, but sandboxed is not the same as safe. Here is how the Wasm security model actually works and where it breaks.
browser-image-compression: Is Client-Side Image Compression Safe?
browser-image-compression shrinks images in the browser before upload. Here is how it works, its security trade-offs, and why client-side compression is never validation.
@aws-sdk/client-s3: A Practical Security Guide
The @aws-sdk/client-s3 package is the AWS SDK for JavaScript v3 S3 client. Here is how to use it securely, from credential handling to why v2 is now end-of-support.
How Secure Is js-cookie? A Practical Security Guide
js-cookie is a tiny, popular cookie helper, but a 2026 attribute-injection flaw shows why the library needs the same scrutiny as any other dependency. Here is what to watch.
npm Hack: How Supply Chain Attacks Work and How to Stay Safe
An npm hack rarely means npm itself was breached. It usually means a maintainer account was phished or a package was hijacked. Here is how these attacks unfold and how to defend your builds.
universal-cookie: Package Review and Cookie Security Basics
A review of the universal cookie npm package: what it does in isomorphic apps, the advisory it inherited through its cookie dependency, and the cookie security flags that matter more than the library.
Dependency Injection in JS: A Practical Security Guide
Dependency injection in JS improves testability, but it also becomes an attack surface when injection is dynamic or unvalidated. Here is how to keep it safe.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.