Developer Tools
npm install or npm ci: which is safer for builds?
npm ci installs exactly what the lockfile says and fails on mismatch, so it is the safer choice for CI. See what it does and does not protect against.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Should CI run npm with ignore-scripts? What it stops and what breaks
ignore-scripts stops npm running package scripts such as install hooks in CI installs. It cuts one attack path but breaks packages that need a build step.
Oct 18, 20263 min read
Developer Tools
How do I find out why a package is in node_modules? Use npm explain
npm explain prints the chain of dependencies that pulled a package into your project. Use it to trace a vulnerable package to a parent you can change.
Oct 18, 20263 min read
Developer Tools
Should a Dockerfile use npm ci or npm install?
Use npm ci in Dockerfiles. It installs exactly what the lockfile says and fails on a mismatch, so builds are repeatable. Here are the steps and the traps.
Oct 18, 20263 min read
Developer Tools
How do you keep npm installs working during a registry outage?
A committed lockfile, npm ci and a warmed cache cover most registry outages. What each does, what it cannot do, and how to test your setup offline.
Oct 18, 20263 min read
Developer Tools
Does npm audit cover every workspace in a monorepo?
npm audit takes workspace options that limit or widen what it checks. See how workspace, workspaces and include-workspace-root change the result.
Oct 18, 20263 min read
Developer Tools
npm audit flags a dev dependency: do I need to fix it?
A flaw in a dev dependency often matters less than one in production code, but not never. Here is how to judge it and which npm audit options to use.
Oct 18, 20263 min read
Developer Tools
How do you normalize messy license names to SPDX identifiers?
Free text names like Apache License, Version 2.0 must map to SPDX ids before a policy can act. A mapping method, edge cases, and what to leave as unknown.
Oct 18, 20263 min read
Developer Tools
Node.js 27 moves to annual releases: what changes for upgrades?
From Node.js 27 the project ships one major a year and every major reaches LTS. What that changes for upgrade planning, and what is still unclear.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.