nodejs
Safeguard articles tagged "nodejs" — guides, analysis, and best practices for software supply chain and application security.
112 articles
dotenv npm: A Security Review and Safe Usage Guide
The dotenv npm package loads environment variables from a .env file into process.env. It is safe and widely used, but how you handle the file around it is where most mistakes happen.
node:20-alpine: Is the Small Image Worth the Tradeoffs?
node:20-alpine gives you the smallest mainstream Node.js base image, but musl libc and a stripped userland come with real caveats. Here is when to use it and how to harden it.
The dataloader npm Package: Security Review and Safe Usage
The dataloader npm package batches and caches data fetches, most often in GraphQL servers. Its security story is less about CVEs and more about cache scoping and how you use it.
Passport (npm): A Security Review and Safe-Usage Guide
A security-focused look at the passport npm package: what it does, the session fixation CVE fixed in 0.6.0, and how to configure authentication safely.
adm-zip npm Security: Zip Slip Risks and Safe Extraction
adm-zip is a popular pure-JavaScript zip library for Node.js, and its history of path-traversal flaws makes safe extraction non-optional. Here is what went wrong and how to use it correctly.
Bun vs Node: A Practical Comparison for 2025
Choosing between Bun vs Node comes down to speed, compatibility, and how much you value a mature ecosystem. Here is an honest breakdown, with Deno in the mix.
Is supertest npm Safe to Use? A Security Review for Node Testing
A security-minded review of supertest npm, the SuperAgent-driven HTTP testing library: where it fits, what its dependency surface looks like, and how to keep test code from leaking into production risk.
Is the Busboy npm Package Safe? A Security Review
The busboy npm package parses multipart form data in Node.js. Here is its current security status, the dicer history that once bit it, and how to use it safely.
Is the npm mysql Package Safe? A Security Review
A security-focused look at the npm mysql driver: SQL injection risks, prepared statements, connection handling, and why most teams should move to mysql2.
Docker Hub Node.js Images: How to Pick and Harden the Right Tag
The official Docker Hub Node.js images come in a dozen variants, and the tag you choose decides your image size, patch cadence, and attack surface. Here is how to read them.
CVE-2023-36665: The protobuf.js Prototype Pollution Vulnerability Explained
CVE-2023-36665 is a critical prototype pollution flaw in protobuf.js that can lead to remote code execution. Here is how it works and how to fix it fast.
date-fns-tz: Time Zone Handling and Package Health Review
A practical review of the npm date-fns-tz package: how it handles IANA time zones, how healthy the project is, and when date-fns v4's built-in time zone support replaces it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.