transitive-dependencies
Safeguard articles tagged "transitive-dependencies" — guides, analysis, and best practices for software supply chain and application security.
28 articles
minimatch npm: Security Review and Safe Usage
The minimatch npm package powers glob matching across the JavaScript ecosystem, and a ReDoS flaw made older versions a denial-of-service risk. Here is what to know and how to stay safe.
Lodash on npm: Prototype Pollution Risks and the Safe Version
The lodash npm package is everywhere, and older versions carry real prototype pollution CVEs. Here are the fixed versions and how to check what your tree resolves to.
npm underscore Security Review: Is It Safe to Use in 2025?
A security review of the npm underscore package, the code-injection CVE in its template function, and whether you still need it in a modern JavaScript stack.
Dependency Graph Analysis: Finding Hidden Transitive Risks
Your project has 50 direct dependencies. It actually depends on 1,200 packages. Transitive dependency analysis is how you find the risks hiding three layers deep.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.