npm
Safeguard articles tagged "npm" — guides, analysis, and best practices for software supply chain and application security.
195 articles
Multer on npm: Security Review and the 2025 DoS Fixes
Multer had a run of denial-of-service advisories through 2025. Here is what each one was, which version fixes them, and how to use the npm package safely.
After the Worms: A CI/CD Security Playbook for Developer Credentials in 2026
The 2026 npm and PyPI worms proved that a trusted release pipeline is a credential vault. Here is what IronWorm and Mini Shai-Hulud actually exploited, and how to harden CI/CD before the next one lands.
react-hook-form npm: A Security Review and Safe Usage Guide
The react-hook-form npm package is a dependency-free form library with a clean security record. The risk is not the library itself but how you validate and handle the data it collects.
Angular CDK: What Ships in @angular/cdk and Keeping It Current
The angular cdk npm package is the behavior layer under Angular Material — overlays, a11y, drag-drop, virtual scroll. Knowing what is inside and how its versioning works keeps upgrades boring.
Formidable npm: Security Review and Safe Usage of the File-Upload Parser
A security review of the formidable npm package: the file-upload risks, the CVEs assigned against it, and how to configure it so uploads stay safe.
What Is a Lockfile?
A lockfile pins the exact versions and hashes of every dependency your build resolves. Here is how lockfiles make builds reproducible and why they are central to supply chain integrity.
Is Node.js Safe? A Security Guide for Production Apps
Is Node.js safe to run in production? The runtime itself is well maintained and secure by modern standards. The real risk lives in the dependency tree and how you configure the app around it.
TrapDoor: The Cross-Ecosystem Crypto Stealer That Targeted DeFi Developers (May 2026)
Socket disclosed TrapDoor on May 24, 2026: 34+ malicious packages and 384+ versions across npm, PyPI, and Crates.io built to steal crypto wallets, SSH keys, and cloud credentials from crypto, DeFi, Solana, and AI developers.
react-slick: Security and Maintenance Guide for 2025
react-slick is a hugely popular carousel component with no known CVEs, but slowing maintenance and its dependency chain are the risks worth watching before you adopt it.
Hugging Face as Malware CDN and Exfiltration Backend: The DPRK-Linked npm Campaign of May 2026
OX Security disclosed a DPRK-aligned campaign that abused Hugging Face as a malware host and data-exfiltration backend, using public repos to serve second-stage payloads and private datasets to receive stolen developer secrets.
The npm figlet Package: A Security Review and Safe Usage Guide
The npm figlet package turns text into ASCII art and is downloaded well over a million times a week. Here is what it does, how to use it, and how to treat even a small utility as part of your supply chain.
What Is a Package Registry?
A package registry is the network service your package manager pulls code from. Here is how registries work, why they are a critical trust boundary, and how to secure what you download.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.