npm-security
Safeguard articles tagged "npm-security" — guides, analysis, and best practices for software supply chain and application security.
171 articles
Monitoring Package Maintainer Changes as a Threat Signal
Most package hijacks start with a maintainer change nobody was watching. Registry metadata makes these events observable — if you bother to look.
webpack-merge: What It Does and How to Use It Securely
webpack-merge cleanly combines webpack configs, but its low release cadence and function-executing merge behavior deserve a security-minded look.
Rimraf npm: Is It Still Worth Installing in 2025?
A security-minded look at the rimraf npm package — what it does, why old versions throw deprecation warnings, and when Node's built-in fs.rm makes it optional.
npm react-scripts: A Security Review and Safe Usage Guide
react-scripts powers Create React App, but CRA is now deprecated and react-scripts carries a stack of aging transitive dependencies. Here is how to handle it safely.
react-native-screens: A Security Guide for React Native Apps
react-native-screens is a low-level navigation dependency most developers never install directly. Here is what it does and how to think about its security in a mobile app.
CVE-2022-37601: Prototype Pollution in loader-utils Explained
CVE-2022-37601 is a prototype pollution flaw in the webpack loader-utils package. Here is what it affects, how it works, and how to remediate it.
Is react-device-detect Safe? A Security Review of the npm Package
A look at react-device-detect, what the library does with user-agent parsing, and the supply-chain and privacy considerations before you add it to a React app.
xmldom Is Deprecated: Vulnerabilities and Migration Options
The npm xmldom package was replaced by @xmldom/xmldom years ago, yet the old name still sits in countless lockfiles with unfixed advisories. Here is how to find it and migrate.
react-native-loading-spinner-overlay: Is It Still Safe to Use?
A security look at react-native-loading-spinner-overlay: its maintenance status, dependency footprint, and how to reason about an unmaintained UI package.
TinyMCE npm Security: XSS History and Safe Configuration
The tinymce npm package is a capable rich-text editor with a long history of XSS advisories. Keeping it current and configuring it defensively is what keeps it safe.
tough-cookie npm: Security Review and Safe Usage
A security review of the tough-cookie npm package, including the CVE-2023-26136 prototype pollution flaw, the version that fixes it, and how to use it safely.
JavaScript Security Issues: Common Risks and How to Fix Them
The JavaScript security issues that bite most teams are XSS, prototype pollution, vulnerable npm dependencies, and leaked secrets. Here is how each works and how to fix it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.