npm
Safeguard articles tagged "npm" — guides, analysis, and best practices for software supply chain and application security.
100 articles
How Do You Create an npm Module Securely?
To create an npm module you need package.json, a clear entry point, and a publish step, but doing it safely means locking down metadata, tokens, and what actually ships. Here is the full walkthrough.
How to Create an npm Package in TypeScript Safely
A practical walkthrough to create an npm package in TypeScript, plus the supply-chain hardening steps most tutorials skip: provenance, dependency hygiene, and safe publishing.
TanStack's Build Pipeline Got Hijacked and Still Signed Valid SLSA Provenance (May 2026)
On May 11, 2026, attackers chained a pull_request_target abuse, cache poisoning, and OIDC token theft to publish 84 malicious @tanstack npm versions from TanStack's own trusted pipeline. It is the first npm compromise to carry valid SLSA provenance.
node-ipc Compromised Again (14 May 2026): An 80 KB Credential Stealer in a 10M-Download Library
On 14 May 2026, three malicious node-ipc versions (9.1.6, 9.2.3, 12.0.1) shipped an 80 KB credential-stealing IIFE appended after module.exports in the CJS bundle — no install scripts, harvesting 90+ secret categories from a library with 10M+ weekly downloads.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.