Open Source
react-native-asset: A Security Guide to Linking Assets
react-native-asset links fonts, sound files, and other assets into iOS and Android builds. Here is how it works and the supply-chain hygiene it deserves.
Feb 24, 20256 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedOpen Source
core-js 2.6.12: Vulnerabilities, EOL Status, and Upgrading to v3
Searching for core-js 2.6.12 vulnerabilities turns up no CVEs — the finding is the abandoned v2 line itself. What the deprecation actually means and how to migrate to core-js 3 cleanly.
Feb 21, 20256 min read
Open Source
npm dd-trace: Security Review and Safe Usage
The npm dd-trace package is Datadog's Node.js APM tracer. It runs deep in your process, so here is an honest look at its security posture and how to deploy it safely.
Feb 19, 20256 min read
Open Source
aws-cdk-lib on npm: Security Review and Safe Usage
aws-cdk-lib is the single monolithic package for AWS CDK v2. Its size and its role as infrastructure code make dependency hygiene and construct review the real security work.
Feb 18, 20255 min read
Open Source
npm Commands: A Security-Focused Guide to Safe Usage
The npm commands you run every day have security consequences. Here is a practical npm commands list with the safe way to use each one.
Feb 18, 20255 min read
Open Source
follow-redirects: Known Vulnerabilities and How to Stay Patched
follow-redirects sits under axios in millions of Node apps. A practical guide to its CVE history and how to keep the pinned version current.
Feb 18, 20256 min read
Open Source
react-router-dom and @types/react-router-dom: Versioning Done Right
Installing npm react router dom packages looks trivial until the types break. Here is how react-router-dom versions map to @types packages, and which combinations are wrong.
Feb 14, 20256 min read
Open Source
@babel/plugin-transform-runtime: What It Does and When You Need It
The babel plugin transform runtime deduplicates Babel's injected helpers and keeps polyfills out of the global scope. Here is what it actually changes in your output, and when it earns its place.
Feb 12, 20256 min read
Open Source
rrule npm Package: Recurrence Rules, Health, and Pitfalls
The rrule npm package is the standard way to handle iCalendar recurrence rules in JavaScript — but it carries timezone traps, unbounded-expansion hazards, and a slow maintenance pulse worth knowing before you depend on it.
Feb 11, 20257 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.