npm
Safeguard articles tagged "npm" — guides, analysis, and best practices for software supply chain and application security.
195 articles
npm package signature verification: the 2026 rollout state
Every package on npm is signed by the registry, but the actual posture of install-time signature verification across real-world tooling is patchier than the headline suggests. This is where npm audit signatures and downstream verifiers stand in 2026.
npm Trusted Publishing walkthrough: retiring long-lived publish tokens
npm Trusted Publishing replaces long-lived publish tokens with short-lived OIDC-issued credentials tied to a specific CI workflow. Here is the 2026 rollout state, what the migration actually looks like, and where the rough edges still are.
Node.js License Compliance: Auditing Your Dependencies
Node.js itself is MIT-licensed, but the real license work is in your node_modules tree. Here is how to audit npm dependency licenses and enforce a compliance policy.
TanStack and the Mini Shai-Hulud npm Worm (May 2026): Anatomy of a CI-Native Supply Chain Attack
On 11-12 May 2026, the TeamPCP-linked Mini Shai-Hulud worm published 84 malicious artifacts across 42 TanStack npm packages in six minutes, then spread to 160+ packages by abusing GitHub Actions OIDC tokens and CI cache poisoning.
npm provenance attestations walkthrough for 2026
npm provenance ties a published package to the specific GitHub Actions run that built it, signed through sigstore. Here is how to enable it for a publisher, verify it on the install side, and enforce it in CI without breaking your release process.
How to Secure webpack-dev-server Against Source Code Theft
webpack-dev-server is a local development server, not a production one, and two 2025 CVEs showed exactly why that distinction matters. Here is how it leaks and how to lock it down.
sanitize-html Vulnerabilities: History and Correct Configuration
A walk through the real npm sanitize-html vulnerabilities, from the 2016 recursion bypass to the 2024 style-attribute leak, and the configuration that keeps the library safe.
How to Make an npm Package: A Step-by-Step Guide
Learning how to make an npm package takes about ten minutes of setup and a lifetime of not shipping your .env file. This guide covers the full path from init to publish, safely.
crypto-browserify: Is the npm Crypto Polyfill Still Safe to Use?
crypto-browserify has no known direct vulnerabilities but hasn't shipped a release in over a year. Here is how to decide whether to keep it, and how to stop bundling it when you don't need it.
Serverless Offline: What It Is and How to Use It Securely
A guide to the serverless-offline npm plugin: what it emulates, where it diverges from real Lambda, and the security gaps to watch when running functions locally.
What is Typo-Squatting Detection
Typo-squatting detection identifies malicious packages named one keystroke away from real ones — requets instead of requests — before they reach your build.
react-query (TanStack Query): Package Health and Data-Fetching Safety
The npm react-query package froze at v3.39.3 when the project moved to @tanstack/react-query. Here is how to tell which one you are running, and how to keep server-state caching from leaking data.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.