nodejs
Safeguard articles tagged "nodejs" — guides, analysis, and best practices for software supply chain and application security.
112 articles
AWS SDK v3 Clients (@aws-sdk/client-s3 and Friends): Security Guide
@aws-sdk/client-s3 and the other modular v3 clients change how credentials, dependencies, and mocking work. Here is the security guidance that should accompany the migration.
npm js-yaml: A Security Review and Safe Usage Guide
npm js-yaml is the standard YAML parser for Node.js. Its history includes real code-execution bugs, and how you call it still decides whether your app is safe.
dotenv npm: A Security Review and Safe Usage Guide
The dotenv npm package loads environment variables from a .env file into process.env. It is safe and widely used, but how you handle the file around it is where most mistakes happen.
node:20-alpine: Is the Small Image Worth the Tradeoffs?
node:20-alpine gives you the smallest mainstream Node.js base image, but musl libc and a stripped userland come with real caveats. Here is when to use it and how to harden it.
The dataloader npm Package: Security Review and Safe Usage
The dataloader npm package batches and caches data fetches, most often in GraphQL servers. Its security story is less about CVEs and more about cache scoping and how you use it.
Passport (npm): A Security Review and Safe-Usage Guide
A security-focused look at the passport npm package: what it does, the session fixation CVE fixed in 0.6.0, and how to configure authentication safely.
adm-zip npm Security: Zip Slip Risks and Safe Extraction
adm-zip is a popular pure-JavaScript zip library for Node.js, and its history of path-traversal flaws makes safe extraction non-optional. Here is what went wrong and how to use it correctly.
Bun vs Node: A Practical Comparison for 2025
Choosing between Bun vs Node comes down to speed, compatibility, and how much you value a mature ecosystem. Here is an honest breakdown, with Deno in the mix.
Is supertest npm Safe to Use? A Security Review for Node Testing
A security-minded review of supertest npm, the SuperAgent-driven HTTP testing library: where it fits, what its dependency surface looks like, and how to keep test code from leaking into production risk.
Is the Busboy npm Package Safe? A Security Review
The busboy npm package parses multipart form data in Node.js. Here is its current security status, the dicer history that once bit it, and how to use it safely.
Docker Hub Node.js Images: How to Pick and Harden the Right Tag
The official Docker Hub Node.js images come in a dozen variants, and the tag you choose decides your image size, patch cadence, and attack surface. Here is how to read them.
Is the npm mysql Package Safe? A Security Review
A security-focused look at the npm mysql driver: SQL injection risks, prepared statements, connection handling, and why most teams should move to mysql2.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.