nodejs
Safeguard articles tagged "nodejs" — guides, analysis, and best practices for software supply chain and application security.
112 articles
npm commander: Security Review and Safe Usage of the CLI Library
The npm commander package is one of the most-downloaded CLI frameworks for Node. Here is a security-focused review of the library and how to use it safely.
How to Verify an npm Package Before Installing It
Five checks that take about four minutes — tarball inspection, install-script review, provenance verification, maintainer signals — before you let a new npm package run code on your machine.
CORS in Node.js: What It Is and How to Configure It Securely
CORS in Node.js trips up almost every developer at some point. Here is what CORS actually does, why you need it, and how to configure it without opening a hole.
Node Media Server Security: Hardening Your Streaming Stack
Node Media Server turns a Node.js process into an RTMP and HTTP-FLV streaming server. Exposed carelessly, it becomes an open door. Here is how to run it safely.
jwt-decode: Why Decoding Is Not Verifying (Security Guide)
The npm jwt-decode package reads JWT claims without checking the signature. That is by design, and it is behind a whole class of authentication bypasses when developers forget it.
Uncaught Exceptions in JavaScript: Handling Them Without Hiding Bugs
A JavaScript uncaught exception is a thrown error that no catch block claims — and the worst response is a global handler that swallows it. Here is how to handle them in Node and the browser without hiding real bugs.
sanitize-html Vulnerabilities: History and Correct Configuration
A walk through the real npm sanitize-html vulnerabilities, from the 2016 recursion bypass to the 2024 style-attribute leak, and the configuration that keeps the library safe.
Is node:18-alpine Still Safe to Use in 2025?
The node:18-alpine image is small and popular, but Node.js 18 reached end of life in April 2025. Here is what that means for your containers and how to migrate cleanly.
Rimraf npm: Is It Still Worth Installing in 2025?
A security-minded look at the rimraf npm package — what it does, why old versions throw deprecation warnings, and when Node's built-in fs.rm makes it optional.
cookie-parser in Express: Security Guide and Best Practices
The cookie-parser npm middleware is deceptively simple, but signed-cookie misuse and a 2024 CVE in its underlying cookie library still catch Express teams out.
AWS SDK v3 Clients (@aws-sdk/client-s3 and Friends): Security Guide
@aws-sdk/client-s3 and the other modular v3 clients change how credentials, dependencies, and mocking work. Here is the security guidance that should accompany the migration.
npm js-yaml: A Security Review and Safe Usage Guide
npm js-yaml is the standard YAML parser for Node.js. Its history includes real code-execution bugs, and how you call it still decides whether your app is safe.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.