Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Deprecated, unlisted and vulnerable are three different NuGet states. Learn what each means, how to find them in your solution, and what to do next.
Yes, since NuGet 6.10, but with limits: no audit mode setting and fewer MSBuild controls. A version table and what to do if you cannot migrate yet.
package-lock.json stays in your repo, while npm-shrinkwrap.json can ship in the package. See when each fits and why libraries should avoid shrinkwrap.
GitHub said it would limit npm publishing to local 2FA, short-lived granular tokens or trusted publishing. What that means and how to prepare packages.
Set license to an SPDX identifier such as MIT, an expression like (ISC OR GPL-3.0), or SEE LICENSE IN a file. UNLICENSED means no rights are granted.
Use the files field, npmignore rules and a dry run to see exactly which files ship in your npm tarball, so secrets and test data never reach the registry.
Overrides replace versions in the tree, aliases rename packages and optional packages may not install. Each can make a scan disagree with reality.
npm lockfiles come in three formats with different sections. Check that your scanner reads all of them, including old files that still sit in repositories.
An npm integrity error means the download does not match the hash in your lockfile. Here are the usual causes, how to investigate, and when to worry.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
