npm-security
Safeguard articles tagged "npm-security" — guides, analysis, and best practices for software supply chain and application security.
100 articles
ngx-bootstrap Security: What to Know After the 2025 npm Compromise
ngx-bootstrap is a popular Angular component library that was hit by a real npm supply-chain attack in September 2025. Here is what happened, what to check, and how to use it safely.
Is the jsPDF npm Package Safe? A Security Review
The jsPDF npm package is widely used for client-side PDF generation, but recent path traversal and ReDoS advisories mean the version you pin matters. Here is what to check.
How Secure Is js-cookie? A Practical Security Guide
js-cookie is a tiny, popular cookie helper, but a 2026 attribute-injection flaw shows why the library needs the same scrutiny as any other dependency. Here is what to watch.
pdf-lib npm: A Security Review and Safe Usage Guide
pdf-lib is a popular pure-JavaScript library for creating and editing PDFs, with no known direct vulnerabilities but an inactive maintenance status worth planning around.
JavaScript Security Vulnerabilities: The Ones That Actually Bite
JavaScript security vulnerabilities cluster around a few patterns: XSS, prototype pollution, ReDoS, and dependency risk. Here is how each works and how to catch it.
Slopsquatting: When AI Hallucinates Package Names
LLMs invent plausible package names; attackers register them and wait. How slopsquatting works, why hallucinations repeat predictably, and the gates that stop it.
Choosing an npm Vulnerability Scanner That Catches Real Threats
npm audit is only the starting point. Here is how an npm vulnerability scanner should handle transitive risk, reachability, install scripts, and lockfile integrity.
PrismJS: Vulnerability History and Hardening Your Syntax Highlighting
The npm prismjs package has patched ReDoS, plugin XSS, and a DOM clobbering flaw over the years. Here is the full history and how to run a syntax highlighter safely.
How Snyk detects malicious and typosquatted open-source p...
How Snyk's research team detects malicious and typosquatted open-source packages — from name-similarity heuristics to install-script analysis and source-code provenance checks.
react-native-flash-message: A Security Guide
The react-native-flash-message package is a popular but no-longer-maintained notification library. Here is what its inactive status means for your app's security.
fast-xml-parser on npm: Security Review and Safe Usage
fast-xml-parser is one of the most-downloaded XML parsers on npm. Here is its security history, the CVEs that mattered, and how to use it safely.
superagent npm: Security Review and Safe HTTP Requests
SuperAgent is a mature HTTP client for Node.js, but old versions carry prototype pollution and information-exposure flaws. Here is a practical security review.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.