javascript
Safeguard articles tagged "javascript" — guides, analysis, and best practices for software supply chain and application security.
93 articles
The moment npm Package in 2025: Security Review and Safe Usage
The moment npm package is in maintenance mode, not abandoned. Here is what that means for security, when it is fine to keep, and what to migrate to when it is not.
How to Make an npm Package: A Step-by-Step Guide
Learning how to make an npm package takes about ten minutes of setup and a lifetime of not shipping your .env file. This guide covers the full path from init to publish, safely.
Is jQuery Validate Safe? Security Risks and Fixes for the Validation Plugin
jQuery Validate is convenient, but a real XSS flaw and the habit of grabbing minified copies off random CDNs make it worth a security look. Here is what to check.
npm crypto-js: A Security Review and Safe Usage Guide
The npm crypto-js library is widely used but has a documented cryptographic weakness before 4.2.0. Here is what to check and how to use it safely.
Inversion of Control in JavaScript: The Security Angle Nobody Explains
Inversion of control in JavaScript decouples your code from its dependencies, but handing over instantiation also hands over a piece of your attack surface. Here is how to get the design benefit without the security cost.
pdfjs-dist on npm: Security Review and Safe Usage
The pdfjs-dist npm package renders PDFs in the browser, but CVE-2024-4367 allowed arbitrary JavaScript execution from a malicious PDF before 4.2.67. Here is what to check.
Showdown Markdown Converter: XSS Risks and Safe Configuration
The npm showdown library converts Markdown to HTML without sanitizing it — by design. Here is where the XSS risk actually lives and how to render untrusted Markdown safely.
msw (npm): Mock Service Worker Without Leaking Mocks Into Production
The msw npm package is a superb API mocking tool, and its main security risk is operational: shipping a service worker or a mock server into production.
Is turndown on npm Safe? A Security Review
turndown converts HTML to Markdown with no known CVEs, but the real risk is what you do with its input and output. Here is how to use it safely.
@babel/plugin-proposal-class-properties: Security and Migration Guide
This Babel plugin is deprecated, not vulnerable. The real risk is supply chain hygiene: depending on an unmaintained package when the standard replacement is a one-line swap.
npm Security Vulnerabilities: How to Track Them
A practical system for tracking npm security vulnerabilities across a real dependency tree, why you shouldn't rely on npm check vulnerabilities output alone, and what to automate.
How to Run JavaScript Code: Methods and Security Notes
A practical guide to how to run JavaScript code in the browser, with Node.js, and from the command line, plus the security traps that turn a convenient runner into a liability.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.