npm-security
Safeguard articles tagged "npm-security" — guides, analysis, and best practices for software supply chain and application security.
171 articles
Lodash on npm: Prototype Pollution Risks and the Safe Version
The lodash npm package is everywhere, and older versions carry real prototype pollution CVEs. Here are the fixed versions and how to check what your tree resolves to.
North Korean Threat Actors Flood npm with Malicious Packages
In 2024, DPRK-linked groups dramatically escalated their campaign to compromise developers through malicious npm packages, using fake job offers and typosquatting to deploy infostealers and backdoors.
ESLint Supply Chain Attack: Malicious npm Packages Targeting Developers
Attackers published malicious packages impersonating ESLint on npm, exploiting developer trust in the popular linting tool to steal credentials.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.