awesome-nodejs-security

left-pad - how one developer broke Node, Babel and thousands of projects in 11 lines of JavaScript.

crossenv - malicious typosquatting package crossenv steals environment variables.

maintainer account with access to conventional-changelog npm package compromised and published malware for 1 day and 11 hours

eslint - malicious packages found in npm package eslint-scope and eslint-config-eslint.

getcookies - malicious package getcookies gets embedded in higher-level express related packages.

event-stream - malicious code found in npm package event-stream.

all with regards to the Russian-Ukraine crisis.

Detect trojan source attacks that employ unicode bidi attacks to inject malicious code.

npm package to assert if preinstall or postinstall scripts are running in your npm or yarn workflows.

Audits an NPM package.json file to identify known vulnerabilities using the

Fast and simple way to check any HTTP Headers.

Pre-install security check for AI agent skills and npm packages. Runs Trust Score analysis before installation to detect malicious patterns, data exfiltration, and prompt injection.

Tool to check for dependency confusion vulnerabilities in multiple package management systems. See

Runs a security audit based on your package.json using the

finds publicly known security vulnerabilities in a website's frontend JavaScript libraries.

Checks filenames to be committed against a library of filename rules to prevent storing sensitive files in Git. Checks some files for sensitive contents (for example authToken inside .npmrc file).

A CLI tool to find and help you fix security and privacy risks in your code according to OWASP Top 10.

CSP Scanner helps developers and security experts to easily inspect and evaluate a site’s Content Security (CSP).

DevSkim is a set of IDE plugins and rules that provide security "linting" capabilities. Also has support for CLI so it can be integrated into CI/CD pipeline.

ESLint plugin to detect and prevent Trojan Source attacks from entering your codebase.

ESLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.

CSP plugin for

fastify-helmet helps you secure your

Helmet helps you secure your Express apps by setting various HTTP headers.

koa-helmet helps you secure your Koa apps by setting various HTTP headers.

CSRF crumb generation and validation for

Node.js CSRF protection middleware.

A plugin for adding CSRF protection to