Open Source
Docker and npm: How to Build Secure Node.js Images
Combining Docker and npm the naive way ships a bloated, vulnerable image. Here is how to build lean, reproducible, and secure Node.js containers.
Apr 30, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedOpen Source
npm install --legacy-peer-deps: What It Does and When It Bites
npm install --legacy-peer-deps tells npm to skip peer dependency resolution entirely, the way npm 4-6 did. That unblocks a broken install today and quietly plants runtime and security problems for later.
Apr 30, 20267 min read
Open Source
Is react-device-detect Safe? A Security Review of the npm Package
A look at react-device-detect, what the library does with user-agent parsing, and the supply-chain and privacy considerations before you add it to a React app.
Apr 30, 20265 min read
Open Source
pdfjs-dist on npm: Security Review and Safe Usage
The pdfjs-dist npm package renders PDFs in the browser, but CVE-2024-4367 allowed arbitrary JavaScript execution from a malicious PDF before 4.2.67. Here is what to check.
Apr 29, 20265 min read
Open Source
Ajv npm: A Security Review and Safe Usage Guide
The ajv npm package is the most widely used JSON Schema validator in the Node ecosystem. Here is what you need to know about its security history and safe configuration.
Apr 29, 20265 min read
Open Source
xmldom Is Deprecated: Vulnerabilities and Migration Options
The npm xmldom package was replaced by @xmldom/xmldom years ago, yet the old name still sits in countless lockfiles with unfixed advisories. Here is how to find it and migrate.
Apr 28, 20266 min read
Open Source
date-fns-tz: Time Zone Handling and Package Health Review
A practical review of the npm date-fns-tz package: how it handles IANA time zones, how healthy the project is, and when date-fns v4's built-in time zone support replaces it.
Apr 28, 20266 min read
Open Source
npm install axios: A Security Review and Safe Usage Guide
Running npm install axios is safe today, but the version you pin matters. Here is a look at the CVEs that have hit axios and how to use it without leaking credentials.
Apr 28, 20265 min read
Open Source
dotenv-webpack: How to Keep Secrets Out of Your Bundle
dotenv-webpack loads .env values into a webpack build, but it inlines them into client code at compile time, so anything you reference ships to the browser in plaintext.
Apr 28, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.