npm
Safeguard articles tagged "npm" — guides, analysis, and best practices for software supply chain and application security.
195 articles
ng-bootstrap: Using and Securing Angular's Bootstrap Widgets
ng-bootstrap gives Angular apps native Bootstrap widgets with no jQuery dependency. Here is how to keep it current and where the real security work actually lives.
react-native-root-toast: A Security Guide
react-native-root-toast renders toast messages above your React Native app. The security questions are about what text you show, which peer versions you pin, and how you audit the dependency.
npm install --legacy-peer-deps: What It Does and When It Bites
npm install --legacy-peer-deps tells npm to skip peer dependency resolution entirely, the way npm 4-6 did. That unblocks a broken install today and quietly plants runtime and security problems for later.
CVE-2023-36665: The protobuf.js Prototype Pollution Vulnerability Explained
CVE-2023-36665 is a critical prototype pollution flaw in protobuf.js that can lead to remote code execution. Here is how it works and how to fix it fast.
start-server-and-test: Reliable E2E Test Startup in CI
start-server-and-test starts your app, waits until a URL responds, runs your tests, then tears the server down. Getting its wait semantics right is the difference between stable and flaky CI.
What is a Trusted Publisher (PyPI and npm)
A trusted publisher lets your CI workflow publish packages with short-lived OIDC tokens instead of stored API keys. Here's how it works on PyPI and where npm stands.
npm install axios: A Security Review and Safe Usage Guide
Running npm install axios is safe today, but the version you pin matters. Here is a look at the CVEs that have hit axios and how to use it without leaking credentials.
isomorphic-fetch: Security Review and Modern Alternatives
isomorphic-fetch has not shipped a release since 2020, yet thousands of projects still install it. What that means for your security posture, and what to use instead.
npm-force-resolutions: Security Review and Safe Usage
npm-force-resolutions pins vulnerable transitive dependencies to safe versions on older npm. Here is how it works, its risks, and why native npm overrides now beat it.
simple-git: Command Injection CVEs and Safe Usage Patterns
The npm simple-git library went through a chain of argument injection CVEs in 2022, each an incomplete fix of the last. The history is a case study in why wrapping a CLI safely is hard.
Webpack Latest Version: Why Staying Current Is a Security Move
The webpack latest version sits in the 5.x line and updates frequently. Here is how to check which version you run, why staying current matters for security, and how to upgrade safely.
cross-fetch: Package Health and Security Review
cross-fetch still ships in thousands of lockfiles as a universal fetch polyfill. A review of its one CVE, its node-fetch dependency, and when you no longer need it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.