awesome-nodejs-security

Node.js Security Cheat Sheet

Audits an NPM package.json file to identify known vulnerabilities using the

Runs a security audit based on your package.json using the

Introspection API for Node.js release metadata. Provides information about release lines, their relative status along with details of each release.

Runs a security audit based on your package.json using npm.

Manage npm-audit results, including options to ignore specific issues in clear and auditable way.

Safely install packages with npm or yarn by auditing them as part of your install process.

Checks filenames to be committed against a library of filename rules to prevent storing sensitive files in Git. Checks some files for sensitive contents (for example authToken inside .npmrc file).

DevSkim is a set of IDE plugins and rules that provide security "linting" capabilities. Also has support for CLI so it can be integrated into CI/CD pipeline.

ESLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.

Prevents you from committing secrets and credentials into git repositories.

lint lockfiles for improved security and trust policies to keep clean from malicious package injection and other insecure configurations.

A static security code scanner for Node.js applications. Including neat UI that can point where the issue is and how to fix it.

CSP plugin for

Helmet helps you secure your Express apps by setting various HTTP headers.

malicious typosquatting package crossenv steals environment variables. References:

Rate limiting middleware for Express applications built on redis.

malicious packages found in npm package eslint-scope and eslint-config-eslint. References

malicious code found in npm package event-stream. References:

malicious package getcookies gets embedded in higher-level express related packages. References:

Simple express/connect middleware to set limit to upload size, set request timeout etc.

CSRF crumb generation and validation for

Node.js CSRF protection middleware.

Escape string for use in HTML.

Escape any string to be a valid JavaScript string literal between double quotes or single quotes.

node-esapi is a minimal port of the ESAPI4JS (Enterprise Security API for JavaScript) encoder.

An npm library of string validators and sanitizers.

Just sufficient output filtering to prevent XSS!

Hands-on and abundant with source code for a practical guide to Securing Node.js web applications.

A GitHub App that gives you instant security feedback in your Pull Requests.

Intrinsic secures your sensitive data from bugs and malicious code, allowing you to run all code safely.

Solid and Node Certified Modules.

Learn the security basics that a senior developer usually acquires over years of experience, all condensed down into one quick and easy handbook.