npm
Safeguard articles tagged "npm" — guides, analysis, and best practices for software supply chain and application security.
195 articles
How to Verify an npm Package Before Installing It
Five checks that take about four minutes — tarball inspection, install-script review, provenance verification, maintainer signals — before you let a new npm package run code on your machine.
Webpack 5 Node Polyfills: node-polyfill-webpack-plugin Explained
node-polyfill-webpack-plugin restores the Node core shims webpack 5 removed. Before you install it, understand what you are re-adding to your bundle and why webpack removed it.
react-loader-spinner: A Security Guide
react-loader-spinner adds ready-made loading spinners to React apps. It is UI-only, so its security story is entirely about dependency hygiene and install-time provenance.
webpack-cli: What It Does and How to Keep It Secure
webpack-cli is the command-line front end to webpack, and as a build-time dependency it deserves the same supply-chain scrutiny as your runtime packages.
react-helmet-async: Is It Safe to Depend On in 2025?
react-helmet-async manages document head tags in React apps, but its maintenance history is bumpy. Here is what the package does, where the risk sits, and how to depend on it safely.
React Fast Marquee: A Security and Maintenance Guide
React Fast Marquee is a lightweight scrolling-marquee component for React. Here is an honest look at its risk profile, maintenance status, and how to use it safely.
npm ssh2-sftp-client: Security Review and Safe Usage
ssh2-sftp-client wraps the ssh2 library in a promise-based SFTP API. Its security posture rests on host key verification and credential handling, which are easy to get wrong.
How Do You Create an npm Module Securely?
To create an npm module you need package.json, a clear entry point, and a publish step, but doing it safely means locking down metadata, tokens, and what actually ships. Here is the full walkthrough.
How to Create an npm Package in TypeScript Safely
A practical walkthrough to create an npm package in TypeScript, plus the supply-chain hardening steps most tutorials skip: provenance, dependency hygiene, and safe publishing.
node-ipc Compromised Again (14 May 2026): An 80 KB Credential Stealer in a 10M-Download Library
On 14 May 2026, three malicious node-ipc versions (9.1.6, 9.2.3, 12.0.1) shipped an 80 KB credential-stealing IIFE appended after module.exports in the CJS bundle — no install scripts, harvesting 90+ secret categories from a library with 10M+ weekly downloads.
TanStack's Build Pipeline Got Hijacked and Still Signed Valid SLSA Provenance (May 2026)
On May 11, 2026, attackers chained a pull_request_target abuse, cache poisoning, and OIDC token theft to publish 84 malicious @tanstack npm versions from TanStack's own trusted pipeline. It is the first npm compromise to carry valid SLSA provenance.
CVE-2021-3918: Prototype Pollution in json-schema Explained
CVE-2021-3918 is a prototype pollution vulnerability in the json-schema npm package that can let crafted input tamper with JavaScript object prototypes. Here is who is affected and how to fix it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.