dev-dependencies
Safeguard articles tagged "dev-dependencies" — guides, analysis, and best practices for software supply chain and application security.
10 articles
npm chai: A Security Review and Safe Usage Guide
Chai is a staple assertion library for JavaScript testing. Here is an honest look at the security profile of the npm chai package and how to keep it out of your production bundle.
@angular-devkit/build-angular: A Security Guide to the Angular Build Package
@angular-devkit/build-angular is the build toolchain behind the Angular CLI. Most of its security risk is transitive, coming from the build and dev-server dependencies it pulls in.
npm copyfiles: A Security Review and Safe Usage Guide
copyfiles is a tiny cross-platform file-copy CLI that a lot of build scripts rely on. Here is its security profile and how to use the npm copyfiles package carefully.
jest-environment-jsdom: Setup, Gotchas, and Supply Chain Notes
Setting up npm jest-environment-jsdom correctly, why it stopped shipping with Jest, and what its jsdom dependency tree means for your test toolchain's security.
babel-jest: What It Does and How to Keep Your Test Toolchain Safe
babel-jest npm sits in almost every Jest install, quietly transforming your code before tests run. Here is what it does and why test toolchains deserve supply chain attention.
nyc on npm: A Security Review and Safe Usage Guide
nyc is the Istanbul command-line coverage tool for Node.js. Here is its security profile and how to run it without leaking source or slowing your pipeline.
mocha npm: Security Review and Safe Usage
The mocha npm test framework runs only code you write, so its direct risk is low, but its dependency tree generates npm audit noise worth understanding.
@angular-eslint/builder: What It Is and How to Use It Safely
The @angular-eslint/builder package wires ESLint into the Angular CLI so you can run ng lint. Here's how it fits your build and where the supply-chain risk actually lives.
typescript-plugin-css-modules: A Dev Dependency Security Guide
typescript-plugin-css-modules gives you typed CSS Modules imports. Here is what it does, why build-time dev tooling is part of your supply chain, and how to keep it safe.
eslint-plugin-jest-dom: What It Secures and What It Does Not
eslint-plugin-jest-dom enforces better jest-dom assertions, but as a dev dependency it also lives in your supply chain. Here is where its real security value and its real risk both sit.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.