Developer Tools
Why did npm update not fix my vulnerable dependency?
npm update respects the semver ranges in package.json and does not edit them by default. Why a vulnerable version stays put, and the steps that move it.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Which npm 2FA setup should a solo publisher use, and what about recovery?
Use 2FA for sign-in and writes, add a security key, and keep recovery codes off your phone. What npm says about modes, codes and the 72-hour hold.
Oct 19, 20263 min read
Developer Tools
What CI changes does an npm to pnpm migration need?
A checklist for the CI side of an npm to pnpm move: installing pnpm, the packageManager field, frozen lockfile in CI, auth tokens and caching.
Oct 19, 20264 min read
Developer Tools
npm says self-signed certificate on your mirror: how do you fix it?
When npm rejects your internal mirror's certificate, trust the CA with cafile instead of switching off strict-ssl. Steps, risks and a CI-safe setup.
Oct 19, 20264 min read
Developer Tools
Why does an npm scan give different results from run to run?
Without a lockfile the dependency tree is rebuilt each time, so two scanners can see two trees. Learn how version ranges and package-lock fix the drift.
Oct 19, 20263 min read
Developer Tools
NPM SBOM: build it from package-lock.json or node_modules?
For npm projects, the lockfile shows what should install and node_modules shows what did. Learn which source to trust and when to compare both.
Oct 19, 20264 min read
Developer Tools
npm sbom or a dedicated plugin: which approach fits your project?
npm has a built-in sbom command and the CycloneDX project ships its own npm tool. Compare formats, options and when each is the simpler choice.
Oct 19, 20264 min read
Developer Tools
How do you use npm query to find risky dependencies?
npm query uses CSS-style selectors to list dependencies by type, name, script or license. Copyable queries for git deps, install scripts and duplicates.
Oct 19, 20264 min read
Developer Tools
What does npm package-lock-only do, and when should you use it?
npm's package-lock-only flag updates or reads package-lock.json without touching node_modules. When it helps, what it skips, and how to review the result.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.