npm-security
Safeguard articles tagged "npm-security" — guides, analysis, and best practices for software supply chain and application security.
172 articles
What is Typosquatting
Typosquatting tricks developers into installing malicious lookalike packages. Learn how it works, real npm/PyPI attacks, and how to detect it.
What Are Malicious Packages
Malicious npm packages steal credentials, mine crypto, or wipe files. Learn how attackers plant them and how to detect and stop them fast.
https-proxy-agent: What It Does and How to Use It Safely
A practical security review of https-proxy-agent, the Node.js module that tunnels HTTPS through an HTTP proxy, plus the advisories worth knowing before you pin a version.
Node.js Vulnerabilities: Tracking and Patching at Scale
How to actually keep up with Node.js vulnerabilities across dozens of services — where advisories come from, what to automate, and what still needs a human.
npm Commands: A Security-Focused Guide to Safe Usage
The npm commands you run every day have security consequences. Here is a practical npm commands list with the safe way to use each one.
node-xlsx Security: Handling Untrusted Excel Files Safely
node-xlsx is a thin wrapper around SheetJS, so its security posture is inherited. Here is what that means for parsing untrusted spreadsheets and how to lock it down.
JavaScript Security Best Practices Every Team Should Actually Follow
Most JavaScript security incidents come from a handful of repeated mistakes. These are the best practices that prevent them, from XSS to the npm dependency graph.
core-js on npm: Security Review and Safe Usage
A security and sustainability review of core-js on npm: the postinstall history, the maintainer funding crisis, and how to keep this near-universal dependency safe.
Lodash on npm: Prototype Pollution Risks and the Safe Version
The lodash npm package is everywhere, and older versions carry real prototype pollution CVEs. Here are the fixed versions and how to check what your tree resolves to.
North Korean Threat Actors Flood npm with Malicious Packages
In 2024, DPRK-linked groups dramatically escalated their campaign to compromise developers through malicious npm packages, using fake job offers and typosquatting to deploy infostealers and backdoors.
Typosquatting packages
What is typosquatting? A precise breakdown of package typosquatting attacks, real npm and PyPI examples, and how lookalike malicious packages slip into builds.
Blocking Malicious Packages at the Proxy Level With Artifactory
Once a compromised dependency reaches a laptop or CI runner, you are doing incident response. Blocked at the Artifactory proxy, it is a log line. Here is the configuration that makes that happen.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.