npm
Safeguard articles tagged "npm" — guides, analysis, and best practices for software supply chain and application security.
186 articles
isomorphic-fetch: Security Review and Modern Alternatives
isomorphic-fetch has not shipped a release since 2020, yet thousands of projects still install it. What that means for your security posture, and what to use instead.
npm-force-resolutions: Security Review and Safe Usage
npm-force-resolutions pins vulnerable transitive dependencies to safe versions on older npm. Here is how it works, its risks, and why native npm overrides now beat it.
simple-git: Command Injection CVEs and Safe Usage Patterns
The npm simple-git library went through a chain of argument injection CVEs in 2022, each an incomplete fix of the last. The history is a case study in why wrapping a CLI safely is hard.
Webpack Latest Version: Why Staying Current Is a Security Move
The webpack latest version sits in the 5.x line and updates frequently. Here is how to check which version you run, why staying current matters for security, and how to upgrade safely.
cross-fetch: Package Health and Security Review
cross-fetch still ships in thousands of lockfiles as a universal fetch polyfill. A review of its one CVE, its node-fetch dependency, and when you no longer need it.
usehooks-ts: A Typed React Hooks Library Reviewed
usehooks-ts packs 30+ typed React hooks into a tree-shakable package with a single dependency. Here is what it does well, where it is aging, and how to vet it before adoption.
Securing actions/setup-node in Your CI Pipeline
The actions/setup-node step looks harmless, but pinning, caching, and registry auth choices decide whether it becomes a supply chain foothold. Here is how to harden it.
React Form Input Packages: react-hook-form, react-phone-input-2, country-state-city
The react-phone-input-2 npm package has half a million weekly downloads and no releases since 2021. A practical review of three form-layer dependencies and what each one really costs.
immer npm: A Security Review and Safe Usage Guide
The immer npm package makes immutable state updates painless, but its older versions carried prototype pollution flaws. Here is its security history and how to depend on it safely.
npm Supply Chain Attacks Q1 2025: Dependency Confusion, Typosquatting, and Maintainer Takeovers
The first quarter of 2025 saw a sharp increase in npm supply chain attacks. We catalog the major incidents and analyze the evolving techniques.
Vetting React Native npm Packages: pager-view, paper, video, config
Before you add react-native-pager-view npm installs to a mobile app, run the same vetting you would for backend code. Here is a practical checklist using four popular packages as case studies.
react-select-async-paginate: A Security Guide
react-select-async-paginate is a thin wrapper over react-select that loads dropdown options page by page. Here is how to use it without inheriting supply chain or data-handling risk.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.