Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A review of the universal cookie npm package: what it does in isomorphic apps, the advisory it inherited through its cookie dependency, and the cookie security flags that matter more than the library.
The npm ws package powers most Node WebSocket servers. CVE-2024-37890 let a flood of request headers crash it. Here is how the flaw works and how to patch.
Setting up npm jest-environment-jsdom correctly, why it stopped shipping with Jest, and what its jsdom dependency tree means for your test toolchain's security.
The react-native-flash-message package is a popular but no-longer-maintained notification library. Here is what its inactive status means for your app's security.
Multer had a run of denial-of-service advisories through 2025. Here is what each one was, which version fixes them, and how to use the npm package safely.
The jose npm package is a well-regarded library for JWT, JWS, and JWE across JavaScript runtimes. It gives you the right primitives; using them securely still comes down to how you verify tokens.
react-test-renderer is now deprecated and unmaintained as of React 19. Here is what that means for your test suite and how to migrate off it safely.
The react-hook-form npm package is a dependency-free form library with a clean security record. The risk is not the library itself but how you validate and handle the data it collects.
fast-xml-parser is one of the most-downloaded XML parsers on npm. Here is its security history, the CVEs that mattered, and how to use it safely.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
