npm
Safeguard articles tagged "npm" — guides, analysis, and best practices for software supply chain and application security.
195 articles
Node.js Docker Containers: Build Small, Run Safe
A Node.js Docker container that is both small and secure: multi-stage builds, npm ci with a lockfile, non-root users, and why you should not run as PID 1.
How npm's Takedown Response Time Compressed from Days to Hours During the 2025 Shai-Hulud Waves
AWS measured the September 8 chalk/debug compromise being removed within 2.5 hours and Shai-Hulud 2.0 in November within 12 hours. Here is how the registry-side response workflow operates and how to consume the signal.
react-number-format: A Security Guide for Safe Input Handling
react-number-format is a popular library for formatting numeric and masked inputs. Here is how to use it without opening XSS or validation gaps.
react-native-asset: A Security Guide to Linking Assets
react-native-asset links fonts, sound files, and other assets into iOS and Android builds. Here is how it works and the supply-chain hygiene it deserves.
core-js 2.6.12: Vulnerabilities, EOL Status, and Upgrading to v3
Searching for core-js 2.6.12 vulnerabilities turns up no CVEs — the finding is the abandoned v2 line itself. What the deprecation actually means and how to migrate to core-js 3 cleanly.
aws-cdk-lib on npm: Security Review and Safe Usage
aws-cdk-lib is the single monolithic package for AWS CDK v2. Its size and its role as infrastructure code make dependency hygiene and construct review the real security work.
How to Detect Dependency Confusion Attacks Before They Ship
Dependency confusion still works in 2026 because teams keep missing the same three controls. Here's how to detect and block it in npm, pip, and Maven.
follow-redirects: Known Vulnerabilities and How to Stay Patched
follow-redirects sits under axios in millions of Node apps. A practical guide to its CVE history and how to keep the pinned version current.
react-router-dom and @types/react-router-dom: Versioning Done Right
Installing npm react router dom packages looks trivial until the types break. Here is how react-router-dom versions map to @types packages, and which combinations are wrong.
Reflection-Based Dependency Confusion Techniques
Dependency confusion is moving beyond name-typosquat. Reflection-based techniques let attackers hijack packages through dynamic imports and runtime resolution.
@babel/plugin-transform-runtime: What It Does and When You Need It
The babel plugin transform runtime deduplicates Babel's injected helpers and keeps polyfills out of the global scope. Here is what it actually changes in your output, and when it earns its place.
rrule npm Package: Recurrence Rules, Health, and Pitfalls
The rrule npm package is the standard way to handle iCalendar recurrence rules in JavaScript — but it carries timezone traps, unbounded-expansion hazards, and a slow maintenance pulse worth knowing before you depend on it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.