Safeguard
Tag

nodejs

Safeguard articles tagged "nodejs" — guides, analysis, and best practices for software supply chain and application security.

112 articles

Open Source

Joi npm: A Security Review and Safe Usage Guide

The joi npm package is the widely used JavaScript schema validation library. Here is its maintenance status, the @hapi/joi migration, and how to use it safely.

Jul 19, 20255 min read
Security

Dependency Injection in JS: A Practical Security Guide

Dependency injection in JS improves testability, but it also becomes an attack surface when injection is dynamic or unvalidated. Here is how to keep it safe.

Jul 15, 20256 min read
Open Source

npm commander: Security Review and Safe Usage of the CLI Library

The npm commander package is one of the most-downloaded CLI frameworks for Node. Here is a security-focused review of the library and how to use it safely.

Jul 15, 20256 min read
Guides

How to Verify an npm Package Before Installing It

Five checks that take about four minutes — tarball inspection, install-script review, provenance verification, maintainer signals — before you let a new npm package run code on your machine.

Jul 9, 20256 min read
DevSecOps

CORS in Node.js: What It Is and How to Configure It Securely

CORS in Node.js trips up almost every developer at some point. Here is what CORS actually does, why you need it, and how to configure it without opening a hole.

Jul 8, 20255 min read
DevSecOps

Node Media Server Security: Hardening Your Streaming Stack

Node Media Server turns a Node.js process into an RTMP and HTTP-FLV streaming server. Exposed carelessly, it becomes an open door. Here is how to run it safely.

Jul 1, 20255 min read
AppSec

jwt-decode: Why Decoding Is Not Verifying (Security Guide)

The npm jwt-decode package reads JWT claims without checking the signature. That is by design, and it is behind a whole class of authentication bypasses when developers forget it.

Jun 18, 20257 min read
AppSec

Uncaught Exceptions in JavaScript: Handling Them Without Hiding Bugs

A JavaScript uncaught exception is a thrown error that no catch block claims — and the worst response is a global handler that swallows it. Here is how to handle them in Node and the browser without hiding real bugs.

Jun 17, 20257 min read
AppSec

sanitize-html Vulnerabilities: History and Correct Configuration

A walk through the real npm sanitize-html vulnerabilities, from the 2016 recursion bypass to the 2024 style-attribute leak, and the configuration that keeps the library safe.

Jun 11, 20257 min read
DevSecOps

Is node:18-alpine Still Safe to Use in 2025?

The node:18-alpine image is small and popular, but Node.js 18 reached end of life in April 2025. Here is what that means for your containers and how to migrate cleanly.

Jun 11, 20255 min read
Open Source

Rimraf npm: Is It Still Worth Installing in 2025?

A security-minded look at the rimraf npm package — what it does, why old versions throw deprecation warnings, and when Node's built-in fs.rm makes it optional.

Jun 11, 20256 min read
AppSec

cookie-parser in Express: Security Guide and Best Practices

The cookie-parser npm middleware is deceptively simple, but signed-cookie misuse and a 2024 CVE in its underlying cookie library still catch Express teams out.

Jun 11, 20256 min read

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.

nodejs (Page 6) — Safeguard Blog