nodejs
Safeguard articles tagged "nodejs" — guides, analysis, and best practices for software supply chain and application security.
112 articles
How to Use the express-validator npm Package Safely
A security-focused review of the express-validator npm package: what it protects you from, what it does not, and how to configure it so bad input never reaches your handlers.
Execa on npm: A Security Review and Safe Usage Guide
Execa is one of the most popular ways to run child processes in Node.js. Here is how to use the execa npm package without opening a command-injection hole.
eslint-plugin-security: How to Catch Node.js Security Bugs at Lint Time
eslint-plugin-security adds static-analysis rules to ESLint that flag risky Node.js patterns before they ship. Here is how to configure it and read its warnings without drowning in noise.
Node.js Backend Security Checklist
A working checklist for securing a Node.js backend: dependency hygiene, input validation, secrets, HTTP headers, and the CI gates that keep regressions out.
Node.js in Docker: Choosing and Securing Your Base Image
The Docker Node base image you pick decides your CVE count before you write a line of code. Here is how to choose between Debian, slim, and Alpine — and harden whichever you pick.
node-fetch: Vulnerability History and the Native fetch Upgrade Path
The npm node-fetch package served a decade of HTTP requests and picked up two notable CVEs along the way. Here is its vulnerability history and how to move to native fetch.
What Causes a Memory Leak in JavaScript (and How to Find One)
A memory leak in JavaScript happens when objects you no longer need stay reachable, so the garbage collector can never free them. Here is how they start and how to hunt them down.
https-proxy-agent: What It Does and How to Use It Safely
A practical security review of https-proxy-agent, the Node.js module that tunnels HTTPS through an HTTP proxy, plus the advisories worth knowing before you pin a version.
undici npm: Security Review and Safe Usage
The undici npm package is Node.js's modern HTTP client and the engine behind the built-in fetch. Here is a review of its security history and how to keep npm undici patched.
npm dd-trace: Security Review and Safe Usage
The npm dd-trace package is Datadog's Node.js APM tracer. It runs deep in your process, so here is an honest look at its security posture and how to deploy it safely.
Is the got npm Package Safe? A Security Review of got for Node.js
got is a well-maintained HTTP client, but one redirect-handling CVE and its SSRF-prone defaults are worth knowing before you ship it. Here is the security review.
chokidar on npm: A Security Review of the File-Watching Library
chokidar is the file-watching library behind most of the Node.js tooling ecosystem, and version 4 cut its dependency count from 13 to 1. Here is what that means for your supply chain risk.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.