npm
Safeguard articles tagged "npm" — guides, analysis, and best practices for software supply chain and application security.
186 articles
FileSaver.js (file-saver): Package Review and Download Security
The file saver npm package still powers client-side downloads in millions of builds, but it has not shipped a release since 2020. Here is what that means for your dependency tree.
zxcvbn npm: Is the Password Strength Library Still Safe to Use?
The zxcvbn npm package still works well for password strength estimation, but the original Dropbox library is effectively unmaintained. Here is what that means and what to use instead.
What package-lock.json Does and Why You Should Commit It
The main package-lock.json use is pinning your entire npm dependency tree to exact, integrity-checked versions so every install is reproducible. Here is what is inside it and why deleting it is a bad habit.
class-validator: Security, Health, and Safe Usage in Production
class-validator powers input validation in most NestJS apps, but its defaults burned teams once before. Here is its real security history and how to configure it safely.
Node.js Docker Containers: Build Small, Run Safe
A Node.js Docker container that is both small and secure: multi-stage builds, npm ci with a lockfile, non-root users, and why you should not run as PID 1.
react-number-format: A Security Guide for Safe Input Handling
react-number-format is a popular library for formatting numeric and masked inputs. Here is how to use it without opening XSS or validation gaps.
react-native-asset: A Security Guide to Linking Assets
react-native-asset links fonts, sound files, and other assets into iOS and Android builds. Here is how it works and the supply-chain hygiene it deserves.
core-js 2.6.12: Vulnerabilities, EOL Status, and Upgrading to v3
Searching for core-js 2.6.12 vulnerabilities turns up no CVEs — the finding is the abandoned v2 line itself. What the deprecation actually means and how to migrate to core-js 3 cleanly.
aws-cdk-lib on npm: Security Review and Safe Usage
aws-cdk-lib is the single monolithic package for AWS CDK v2. Its size and its role as infrastructure code make dependency hygiene and construct review the real security work.
follow-redirects: Known Vulnerabilities and How to Stay Patched
follow-redirects sits under axios in millions of Node apps. A practical guide to its CVE history and how to keep the pinned version current.
react-router-dom and @types/react-router-dom: Versioning Done Right
Installing npm react router dom packages looks trivial until the types break. Here is how react-router-dom versions map to @types packages, and which combinations are wrong.
@babel/plugin-transform-runtime: What It Does and When You Need It
The babel plugin transform runtime deduplicates Babel's injected helpers and keeps polyfills out of the global scope. Here is what it actually changes in your output, and when it earns its place.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.