node-js
Safeguard articles tagged "node-js" — guides, analysis, and best practices for software supply chain and application security.
27 articles
Dependency Injection in JavaScript: Security Notes
Dependency injection in JavaScript makes code testable and modular, but the same indirection that helps design can hide security bugs if you're not careful about what gets injected.
JavaScript Vulnerability Scanners: How They Actually Work
A javascript vulnerability scanner has to reason about a dynamically typed, dependency-heavy language — which is why the good ones combine static analysis with dependency-graph lookups rather than relying on either alone.
pdfmake npm: A Security Review and Safe Usage Guide
pdfmake is a popular client and server PDF generator, but its dependency chain and server-side usage carry real risks. Here is a practical security review.
How to Pull and Secure a Node Image from Docker Hub
The official Docker Hub node image ships in several variants that differ wildly in size and CVE count. Here is how to pick one and lock it down.
Using EJS on npm Safely: CVE-2022-29078 and Beyond
The ejs npm package is a capable template engine that has also been the subject of a serious RCE advisory. Here is how to use it without opening that door.
Fastify Security Posture in 2024
Fastify hit version 5.0 in September 2024 with a slimmer core, a plugin model that encourages correctness, and a security track record that genuinely distinguishes it from the Express crowd. Here is what I have learned auditing Fastify apps this year.
Prototype Pollution in JavaScript: Prevention Guide
Prototype pollution lets attackers modify the behavior of all JavaScript objects by injecting properties into Object.prototype. This guide covers exploitation techniques, real-world impact, and layered defenses.
npm Lifecycle Scripts: The Hidden Attack Surface in Your Node.js Supply Chain
npm lifecycle scripts execute arbitrary code during package installation. This design choice creates one of the largest and least-understood attack surfaces in modern software development.
Node.js Permission Model: Restricting What Your Code Can Do
Node.js finally has an experimental permission model. It is a significant step toward containing supply chain attacks, but it has important limitations.
npm Registry Governance and the Security of node_modules
The npm registry serves billions of downloads per week. Its governance decisions directly impact the security of every Node.js application on the planet.
Express.js Security Middleware: An Audit
Express remains the default Node.js framework at most shops, and its middleware ecosystem is a thirteen-year accumulation of packages, some abandoned, some indispensable. This is a pragmatic audit of what belongs in a 2023 Express stack.
Electron ContextBridge Security: Building Safe Desktop Apps
Electron's ContextBridge is the secure boundary between web content and Node.js APIs. This guide covers how to use it correctly, common mistakes that create RCE vulnerabilities, and security best practices for Electron applications.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.