Contents

• Tools
  • Web Framework Hardening
  • Static Code Analysis
  • Dynamic Application Security Testing
  • Input/Output Validation
  • Secure Composition
  • CSRF
  • Vulnerabilities and Security Advisories
  • Security Hardening
• Data Sources
• Security Incidents
• Educational
  • Hacking Playground
  • Articles
  • Research Papers
  • Books
  • Roadmaps
• Companies

Tools

Web Framework Hardening

• Helmet - Helmet helps you secure your Express apps by setting various HTTP headers.
• koa-helmet - koa-helmet helps you secure your Koa apps by setting various HTTP headers.
• blankie - CSP plugin for hapi.
• fastify-helmet - fastify-helmet helps you secure your fastify apps by setting important security headers.
• nis2-express-middleware - Comprehensive Express.js middleware for EU NIS2 compliance (logging, active defense, and secure defaults).
• nuxt-security - 🛡 Security Module for Nuxt based on OWASP Top 10 and Helmet.
• reporting-api - Express middleware to collect CSP, COOP/COEP, Permissions-Policy, NEL, crash and deprecation reports (Reporting API v0/v1 and legacy report-uri).

GitHub Actions and CI/CD Security

• New dependencies advisor - GitHub Action adding comments to pull requests with package health information about newly added npm dependencies.
• OpenSSF Scorecard Monitor - Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts.

Static Code Analysis

• eslint-plugin-security - ESLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.
• tslint-plugin-security - TSLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.
• safe-regex - detect potentially catastrophic exponential-time regular expressions by limiting the star height to 1.
• vuln-regex-detector - This module lets you check a regex for vulnerability. In JavaScript, regular expressions (regexes) can be "vulnerable": susceptible to catastrophic backtracking. If your application is used on the client side, this can be a performance issue. On the server side, this can expose you to Regular Expression Denial of Service (REDOS).
• regolith - Regex library for TypeScript made to prevent ReDoS attacks I made TypeScript bindings for the Rust Regex library to prevent Regular Expression Denial of Service attacks.
• git-secrets - Prevents you from committing secrets and credentials into git repositories.
• DevSkim - DevSkim is a set of IDE plugins and rules that provide security "linting" capabilities. Also has support for CLI so it can be integrated into CI/CD pipeline.
• ban-sensitive-files - Checks filenames to be committed against a library of filename rules to prevent storing sensitive files in Git. Checks some files for sensitive contents (for example authToken inside .npmrc file).
• NodeJSScan - A static security code scanner for Node.js applications. Including neat UI that can point where the issue is and how to fix it.
• NodeSecure CLI - Node.js CLI that allow you to deeply analyze the dependency tree of a given npm package or a directory.
• Trust But Verify - TBV compares an npm package with its source repository to ensure the resulting artifact is the same.
• lockfile-lint - lint lockfiles for improved security and trust policies to keep clean from malicious package injection and other insecure configurations.
• pkgsign - A CLI tool for signing and verifying npm and yarn packages.
• semgrep - Open-source, offline, easy-to-customize static analysis for many languages. Some others on this list (NodeJSScan) use semgrep as their engine.
• npm-scan - An extensible, heuristic-based vulnerability scanning tool for installed npm packages.
• js-x-ray - JavaScript and Node.js SAST scanner capable of detecting various well-known malicious code patterns (Unsafe import, Unsafe stmt, Unsafe RegEx, encoded literals, minified and obfuscated codes).
• cspscanner - CSP Scanner helps developers and security experts to easily inspect and evaluate a site’s Content Security (CSP).
• eslint-plugin-anti-trojan-source - ESLint plugin to detect and prevent Trojan Source attacks from entering your codebase.
• sdc-check - Small tool to inform you about potential risks in your project dependencies list
• fix-lockfile-integrity - A CLI tool to fix weak integrity hash (sha1) to a more secure integrity hash (sha512) in your npm lockfile.
• Bearer - A CLI tool to find and help you fix security and privacy risks in your code according to OWASP Top 10.
• GuardDog - GuardDog is a CLI tool to Identify malicious PyPI and npm packages
• repolyze - Analyze a git source code repository for health signals and project vitals
• eslint-plugin-node-security - ESLint rules for the Node.js core APIs (fs, child_process, vm, path, Buffer) that catch command injection, path traversal and code execution patterns, with a CWE reference on every report.