npm
Safeguard articles tagged "npm" — guides, analysis, and best practices for software supply chain and application security.
100 articles
"Fully Compromised": What 7,700 npm Malware Advisories Say, and What the Analysis Adds
GitHub's npm malware advisories tell you to treat the machine as fully compromised and rotate every secret. OSV's 2026 data: 7,700 npm records carry that paragraph, 2,018 carry nothing else, and 5,682 include an analysis of what the code did. Where they part ways, and a script to scope your response.
Malware Records List Versions, Not Packages: Why leakdeep 2.6.2 Scans Clean
Malware records usually list the exact versions someone analysed, and scanners match only those. 2026 OSV data for PyPI and npm, the leakdeep credential stealer whose version 2.6.2 isn't in its record, and a script that checks lockfiles by package name.
No-Fix Advisories Let Newer Versions Scan Clean: 2026 Data
534 of 569 no-fix advisories from 2026 use a version ceiling, and scanners treat anything above it as clean. For 54% of those we could check, a newer stable release already exists. Data, method and a checker.
fast-jwt CVE-2026-107722: The Algorithm Confusion Fix That Only Trimmed Whitespace
fast-jwt has now fixed the same RSA-to-HMAC algorithm confusion bug three times. CVE-2026-107722 (CVSS 9.8) shows why trimming whitespace was not enough, who is exposed through @fastify/jwt, and the settings that would have blocked every variant.
TinaCMS CVE-2026-108261: One Link, and the Preview Frame Becomes the Attacker's
One link opened by a signed-in TinaCMS editor could hand an attacker that editor's access to the content API. How the preview origin check was defeated, why filtering the URL would not have worked, and two sibling bugs fixed in the same release.
The Fix Ships First: In 2026, Patched Releases Beat the Advisory by a Median of 10 Days
In 97% of 4,259 PyPI and npm advisories published in 2026, the fixed version was on the registry before the advisory went public, by a median of 10 days. Why the advisory is a late signal, this week's examples, and how to watch releases without walking into compromised updates.
npm URL Dependencies: How Malware Keeps Its Payload Off the Registry, and the Settings That Stop It
Malicious npm packages hide payloads behind URL dependencies. How allow-remote and lockfiles stop them, which Node versions lack it, and a scanner.
Malicious Baileys Forks on npm: 240 Malware Records, and Why --ignore-scripts Doesn't Stop Them
Malicious Baileys forks use the bot's own WhatsApp session to follow channels. OSV data to 17 Oct, why npm defenses miss it, and a checker.
Backstage's August Security Release: 43 Advisories, a 40-Day Scanner Gap, and Four Still Missing
Backstage published 43 security advisories from 28 Aug. Scanners saw most 40 days later and four still not at all. What to upgrade and how to check.
Qwik CVE-2026-84994: One Request, One Thenable, and a Node Server That Exits
Qwik CVE-2026-84994 let one request crash a Node server through a deserialized thenable. The fix, a lab, and a Qwik 2 version-string trap for scanners.
Appium CVE-2026-103975: The Zip Slip That Name Checks Can't See
Appium's second Zip Slip fix: clean entry names, a symlink entry, and a file written through it. The fix, a lab across extractors, and a lockfile check.
The Twenty-Minute Review to Run Before You Add a Dependency
Adding a dependency takes ten seconds and commits you to trusting a stranger's code on your build machines for as long as the project lives. Six checks, the signals that should stop you, and what this deliberately does not defend against.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.