javascript
Safeguard articles tagged "javascript" — guides, analysis, and best practices for software supply chain and application security.
93 articles
What Is vm2? The Node.js Sandbox and Its Security History
vm2 was the most popular way to run untrusted JavaScript inside Node.js — until a string of sandbox-escape CVEs and its 2023 deprecation showed why sandboxing a dynamic language is so hard to get right.
webpack-bundle-analyzer: Find Bloat and Risky Dependencies in Your Bundle
webpack bundle analyzer turns your build output into a zoomable treemap. Used well, it finds not just bloat but duplicated packages, surprise transitive dependencies, and code you never meant to ship.
broadcast-channel npm Package: Health, Security, and Alternatives
A practitioner review of the broadcast-channel npm package: maintenance health, how its storage fallbacks work, the security boundaries of cross-tab messaging, and when the native API is enough.
babel-core Security: Known CVEs and How to Stay Patched
babel-core is safe when current, but its dependency chain has carried a code-execution CVE and a ReDoS issue. Here is what to patch and why re-compiling matters.
npm Supply Chain Attacks Q1 2025: Dependency Confusion, Typosquatting, and Maintainer Takeovers
The first quarter of 2025 saw a sharp increase in npm supply chain attacks. We catalog the major incidents and analyze the evolving techniques.
Reachability Analysis for JavaScript and TypeScript in 2026
JS reachability with npm's nested trees, dynamic require, ESM/CJS interop, and bundler dead code elimination. What modern tools resolve and what they punt.
What Is a Node.js Backend? A Security Guide for Server-Side JavaScript
A practical look at building a Node.js backend that holds up in production, from dependency risk to input validation, with real config you can copy.
jQuery 3.6.0 Vulnerabilities: What Scanners Flag and How to Fix
jQuery v3.6.0 vulnerabilities show up in scan reports constantly, yet the core library has no CVE of its own at that version. Here is what your scanner is actually reacting to and how to clear it.
FileSaver.js (file-saver): Package Review and Download Security
The file saver npm package still powers client-side downloads in millions of builds, but it has not shipped a release since 2020. Here is what that means for your dependency tree.
npm rollup: A Security Review and Safe Usage Guide
A practical look at what installing rollup from npm means for your supply chain, the DOM clobbering XSS bug you should know about, and how to pin a safe version.
Is the Cheerio npm Package Safe? A Security Review
A practitioner's look at the cheerio npm package: what it does, where its real security risk lives, and how to use it safely in production scrapers and parsers.
Mobile Number Validation in JavaScript: A Security-Aware Guide
Mobile number validation in JavaScript is easy to get wrong with a naive regex. Here is how to validate phone numbers correctly, safely, and without ReDoS.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.