Open Source
Is the npm xlsx Package Safe? A Security Review
A security review of the npm xlsx (SheetJS) package: its prototype pollution and ReDoS CVEs, the npm-versus-CDN patch gap, and how to install it safely.
Apr 22, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedOpen Source
npm-force-resolutions: Security Review and Safe Usage
npm-force-resolutions pins vulnerable transitive dependencies to safe versions on older npm. Here is how it works, its risks, and why native npm overrides now beat it.
Apr 22, 20265 min read
Open Source
npm pack: How to Publish Without Leaking Secrets
npm pack builds the exact tarball that would be published to the registry. Using it before every publish is the simplest way to avoid shipping secrets.
Apr 21, 20265 min read
Open Source
react-oidc-context: A Security Guide
react-oidc-context wraps oidc-client-ts in React hooks for SPA authentication. Here is how to wire it up without leaking tokens or trusting the wrong callback.
Apr 21, 20266 min read
Open Source
@babel/plugin-proposal-class-properties: Security and Migration Guide
This Babel plugin is deprecated, not vulnerable. The real risk is supply chain hygiene: depending on an unmaintained package when the standard replacement is a one-line swap.
Apr 21, 20265 min read
Open Source
Is react-native-background-upload Safe to Ship?
react-native-background-upload moves files while your app is backgrounded, which is exactly why its security depends on how you handle URLs, tokens, and native permissions.
Apr 20, 20265 min read
Open Source
Webpack Latest Version: Why Staying Current Is a Security Move
The webpack latest version sits in the 5.x line and updates frequently. Here is how to check which version you run, why staying current matters for security, and how to upgrade safely.
Apr 19, 20265 min read
Open Source
cross-fetch: Package Health and Security Review
cross-fetch still ships in thousands of lockfiles as a universal fetch polyfill. A review of its one CVE, its node-fetch dependency, and when you no longer need it.
Apr 19, 20266 min read
Open Source
react-native-google-places-autocomplete: A Security Guide
The react-native-google-places-autocomplete component makes location search easy, but it can also leak your Google API key straight out of a shipped app. Here's how to use it safely.
Apr 19, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.