Open Source
react-csv and CSV Injection: Exporting Data From React Safely
react-csv makes CSV downloads a one-component job, but it does not sanitize formula injection. Here is how to use it and where you own the security.
Apr 19, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedOpen Source
npm bluebird in 2025: Is the Promise Library Still Safe to Use?
The npm bluebird package still gets tens of millions of weekly downloads, but it has gone quiet. Here is an honest read on whether to keep it or migrate.
Apr 18, 20265 min read
Open Source
The npm prepare Script: What It Does and How to Use It Safely
The npm prepare lifecycle script runs at more moments than most developers realize, including when someone installs your package from git. Here is exactly when it fires and how to keep it from becoming an attack vector.
Apr 18, 20266 min read
Open Source
usehooks-ts: A Typed React Hooks Library Reviewed
usehooks-ts packs 30+ typed React hooks into a tree-shakable package with a single dependency. Here is what it does well, where it is aging, and how to vet it before adoption.
Apr 17, 20267 min read
Open Source
Is react-native-svg-transformer Safe to Use? A Security Guide
react-native-svg-transformer lets you import SVG files as React components in Metro, but it runs at build time and pulls a dependency tree worth reviewing. Here's how to use it safely.
Apr 17, 20265 min read
Open Source
Is react-native-image-crop-picker Safe? A Security Guide
react-native-image-crop-picker is a popular native module for photo selection and cropping in React Native apps. Here is how to assess its risk and use it safely.
Apr 17, 20267 min read
Open Source
Is the npm qs Package Safe? A Security Review of qs
The npm qs package parses query strings under most Express apps, and a prototype pollution flaw once let a single URL hang your Node process. Here is what to check and how to use qs safely.
Apr 17, 20266 min read
Open Source
React Form Input Packages: react-hook-form, react-phone-input-2, country-state-city
The react-phone-input-2 npm package has half a million weekly downloads and no releases since 2021. A practical review of three form-layer dependencies and what each one really costs.
Apr 17, 20266 min read
Open Source
immer npm: A Security Review and Safe Usage Guide
The immer npm package makes immutable state updates painless, but its older versions carried prototype pollution flaws. Here is its security history and how to depend on it safely.
Apr 16, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.