Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
npm re-checks the source repo and commit each time you view a package's provenance. If the repo is deleted or private, you get an error. What to do next.
npm has two config options for ignoring very new package versions. How min-release-age and before differ, which wins, and when each one fits.
Which npm version range to use: caret, tilde or exact. What each allows, when to choose it, and why the lockfile matters more than package.json.
The npm CLI documents an allowScripts policy, approve-scripts command and strict mode for install scripts. How they work and what is advisory today.
Map your internal scope to your private registry in a committed .npmrc so internal names cannot be resolved from the public registry by mistake.
A quiet repository can mean a finished library or an abandoned one. Five checks to tell the difference before you adopt it or keep depending on it.
With no lockfile and a compromised dependency, five evidence sources can show what was installed: artifacts, CI logs, images, caches and proxy logs.
ID.RA-09 asks that authenticity and integrity of software are assessed before use. See which checksums, signatures and provenance records can show it.
Seven intake questions for a new library in a health app: what it does, what data it touches, what it phones home, and who maintains it over time.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
