npm
Safeguard articles tagged "npm" — guides, analysis, and best practices for software supply chain and application security.
186 articles
rrule npm Package: Recurrence Rules, Health, and Pitfalls
The rrule npm package is the standard way to handle iCalendar recurrence rules in JavaScript — but it carries timezone traps, unbounded-expansion hazards, and a slow maintenance pulse worth knowing before you depend on it.
npm handlebars: A Security Review and Safe Usage Guide
The npm handlebars package is a widely used templating engine with a history of prototype pollution issues. Here is what to know before you depend on it and how to use it safely.
cross-env and the crossenv Typosquat: A Supply Chain Case Study
In 2017, a malicious crossenv package on npm stole environment variables from developers who mistyped cross-env. The incident is still the cleanest case study in typosquatting we have.
node-pre-gyp and node-gyp: The Security Cost of Native Modules
@mapbox/node-pre-gyp downloads compiled binaries into your node_modules at install time. Understanding that machinery is the difference between a fast install and an unauditable one.
npm uninstall package: How to Safely Remove Dependencies
How the npm uninstall package command works, what it leaves behind, and how to confirm a removed dependency is actually gone from your tree and your risk surface.
minimatch npm: Security Review and Safe Usage
The minimatch npm package powers glob matching across the JavaScript ecosystem, and a ReDoS flaw made older versions a denial-of-service risk. Here is what to know and how to stay safe.
The xss npm Package: Sanitizing HTML Input Correctly
The xss npm package is a whitelist-based HTML sanitizer for Node and the browser. It works well — when you sanitize in the right place, with the right whitelist, for the right output context.
What is a Package Registry Mirror
A package registry mirror is a local copy or caching proxy of a public registry. It keeps builds running when npm is down — and controls what enters your supply chain.
What is Dependency Pinning
Dependency pinning locks every package in your build to an exact, verified version so the code you tested is the code you ship. Here's how to do it per ecosystem.
Node.js License: What Actually Applies to Your App
Node.js itself ships under a permissive MIT-style license, but your app's real license exposure comes from the hundreds of npm packages riding along with it.
npm Package Takeover: The Summer 2024 Wave
Between May and June 2024 at least 36 npm packages were hijacked via expired maintainer domains and leaked tokens. We map the cluster.
CVE-2022-24785: The Moment.js Path Traversal, Explained
A user-controlled locale string was all it took: how CVE-2022-24785 let attackers traverse paths through Moment.js locale loading on Node.js, and why the fix is a one-line upgrade.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.