Open Source
Is the Sharp npm Package Safe? A Security Review
A security review of the sharp npm image-processing library: its native dependency risk, the libwebp CVE that hit it, and how to run npm sharp safely.
May 6, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedOpen Source
adm-zip npm Security: Zip Slip Risks and Safe Extraction
adm-zip is a popular pure-JavaScript zip library for Node.js, and its history of path-traversal flaws makes safe extraction non-optional. Here is what went wrong and how to use it correctly.
May 6, 20265 min read
Open Source
Interpolation in Angular: How It Works and Where the XSS Risks Hide
Interpolation in Angular binds component data into templates and is safe by default because Angular escapes it. The danger starts when you reach for bypasses.
May 6, 20266 min read
Open Source
npm crypto-js: A Security Review and Safe Usage Guide
The npm crypto-js library is widely used but has a documented cryptographic weakness before 4.2.0. Here is what to check and how to use it safely.
May 5, 20265 min read
Open Source
npm react-scripts: A Security Review and Safe Usage Guide
react-scripts powers Create React App, but CRA is now deprecated and react-scripts carries a stack of aging transitive dependencies. Here is how to handle it safely.
May 5, 20265 min read
Open Source
React Bootstrap Icons: Adding Icons Without Adding Risk
React Bootstrap Icons is a convenient SVG icon set for React apps. Here is how to use it and how to keep the dependency from becoming a supply-chain liability.
May 5, 20265 min read
Open Source
react-signature-canvas: A Security and Maintenance Review
A security review of react-signature-canvas: what the component does, its inactive maintenance status, the XSS surface to watch, and how to use it safely.
May 4, 20265 min read
Open Source
react-query (TanStack Query): Package Health and Data-Fetching Safety
The npm react-query package froze at v3.39.3 when the project moved to @tanstack/react-query. Here is how to tell which one you are running, and how to keep server-state caching from leaking data.
May 4, 20267 min read
Open Source
react-native-modal-datetime-picker: Security and Maintenance Guide
The react-native-modal-datetime-picker package is popular and convenient, but its maintenance status and transitive dependencies deserve a look before you commit to it.
May 4, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.