Developer Tools
Do npm overrides work inside a workspace package.json?
npm overrides are read only from the root package.json. Overrides in a workspace or installed dependency are ignored. How to patch a vulnerable package.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Why npm overrides in my library do not fix my users' vulnerability
npm overrides only apply in the root package.json, so a library cannot use them to patch a dependency for users. What to do instead, step by step.
Oct 19, 20264 min read
Developer Tools
npm outdated: what do wanted and latest mean for your SBOM?
Wanted is the highest version your range allows, latest is the registry tag. Use the gap to sort SBOM components into safe bumps and real migrations.
Oct 19, 20263 min read
Developer Tools
What do npm link and file: dependencies do to your lockfile?
npm link makes a symlink and is not saved to package.json by default. file: paths are saved. What each does to installs, lockfiles, publishing and review.
Oct 19, 20264 min read
Developer Tools
Can npm install-strategy linked catch phantom dependencies?
npm's linked install strategy exposes only declared dependencies, so an undeclared import fails in development. What it catches, misses, and how to use it.
Oct 19, 20263 min read
Developer Tools
npm install printed a deprecation message. Is it a security issue?
An npm deprecation message is a maintainer note, not an advisory and not a removal. Here is how to read it, check for a real advisory and pick a next step.
Oct 19, 20263 min read
Developer Tools
npm install or npm ci: which should a new developer run?
Run npm ci on a fresh clone to install exactly what the lockfile says. Use npm install only when you mean to change dependencies. Here is the difference.
Oct 19, 20263 min read
Developer Tools
Why does npm install fail on node alpine and how do I fix it safely?
Native add-ons need a compiler that alpine images lack. Install the toolchain in a build stage only, so it never reaches production. Steps and trade-offs.
Oct 19, 20263 min read
Developer Tools
How should a solo developer configure an npm granular access token?
Scope it to one package, set an expiry, limit IP ranges, and leave bypass 2FA off unless CI needs it. What npm documents about granular tokens.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.