Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
How the npm uninstall package command works, what it leaves behind, and how to confirm a removed dependency is actually gone from your tree and your risk surface.
The minimatch npm package powers glob matching across the JavaScript ecosystem, and a ReDoS flaw made older versions a denial-of-service risk. Here is what to know and how to stay safe.
The lodash npm package is everywhere, and older versions carry real prototype pollution CVEs. Here are the fixed versions and how to check what your tree resolves to.
npm run executes the scripts defined in your package.json. Here is how it resolves commands, the lifecycle hooks that run automatically, and the supply-chain risks to watch.
chokidar is the file-watching library behind most of the Node.js tooling ecosystem, and version 4 cut its dependency count from 13 to 1. Here is what that means for your supply chain risk.
A security review of the npm underscore package, the code-injection CVE in its template function, and whether you still need it in a modern JavaScript stack.
Software Heritage archives the world's source code. Here is why that matters for supply chain security, reproducibility, and long-term software integrity.
The software industry runs on open source maintained by unpaid volunteers. Until we fix the funding problem, we can't fix the security problem.
Burned-out maintainers abandon projects, accept risky PRs without review, and hand off keys to strangers. The burnout crisis is a supply chain security crisis.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
