fastify-helmet - fastify-helmet helps you secure your fastify apps by setting important security headers.
nis2-express-middleware - Comprehensive Express.js middleware for EU NIS2 compliance (logging, active defense, and secure defaults).
nuxt-security - 🛡 Security Module for Nuxt based on OWASP Top 10 and Helmet.
reporting-api - Setup and collect CSP, Reporting API v0 and v1 reports to reliabily parse them to be processed by the user
GitHub Actions and CI/CD Security
New dependencies advisor - GitHub Action adding comments to pull requests with package health information about newly added npm dependencies.
OpenSSF Scorecard Monitor - Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts.
Static Code Analysis
eslint-plugin-security - ESLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.
tslint-plugin-security - TSLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.
safe-regex - detect potentially catastrophic exponential-time regular expressions by limiting the star height to 1.
vuln-regex-detector - This module lets you check a regex for vulnerability. In JavaScript, regular expressions (regexes) can be "vulnerable": susceptible to catastrophic backtracking. If your application is used on the client side, this can be a performance issue. On the server side, this can expose you to Regular Expression Denial of Service (REDOS).
regolith - Regex library for TypeScript made to prevent ReDoS attacks I made TypeScript bindings for the Rust Regex library to prevent Regular Expression Denial of Service attacks.
git-secrets - Prevents you from committing secrets and credentials into git repositories.
DevSkim - DevSkim is a set of IDE plugins and rules that provide security "linting" capabilities. Also has support for CLI so it can be integrated into CI/CD pipeline.
ban-sensitive-files - Checks filenames to be committed against a library of filename rules to prevent storing sensitive files in Git. Checks some files for sensitive contents (for example authToken inside .npmrc file).
NodeJSScan - A static security code scanner for Node.js applications. Including neat UI that can point where the issue is and how to fix it.
NodeSecure CLI - Node.js CLI that allow you to deeply analyze the dependency tree of a given npm package or a directory.
Trust But Verify - TBV compares an npm package with its source repository to ensure the resulting artifact is the same.
lockfile-lint - lint lockfiles for improved security and trust policies to keep clean from malicious package injection and other insecure configurations.
pkgsign - A CLI tool for signing and verifying npm and yarn packages.
semgrep - Open-source, offline, easy-to-customize static analysis for many languages. Some others on this list (NodeJSScan) use semgrep as their engine.
npm-scan - An extensible, heuristic-based vulnerability scanning tool for installed npm packages.
js-x-ray - JavaScript and Node.js SAST scanner capable of detecting various well-known malicious code patterns (Unsafe import, Unsafe stmt, Unsafe RegEx, encoded literals, minified and obfuscated codes).
cspscanner - CSP Scanner helps developers and security experts to easily inspect and evaluate a site’s Content Security (CSP).
sdc-check - Small tool to inform you about potential risks in your project dependencies list
fix-lockfile-integrity - A CLI tool to fix weak integrity hash (sha1) to a more secure integrity hash (sha512) in your npm lockfile.
Bearer - A CLI tool to find and help you fix security and privacy risks in your code according to OWASP Top 10.
GuardDog - GuardDog is a CLI tool to Identify malicious PyPI and npm packages
repolyze - Analyze a git source code repository for health signals and project vitals
Dynamic Application Security Testing
PurpleTeam - A security regression testing SaaS and CLI, perfect for inserting into your build pipelines. You don’t need to write any tests yourself. purpleteam is smart enough to know how to test, you just need to provide a Job file which tells purpleteam what you want tested.
Input Validation & Output Encoding
node-esapi - node-esapi is a minimal port of the ESAPI4JS (Enterprise Security API for JavaScript) encoder.
is-path-inside-secure - is-path-inside-secure is a symlink-aware implementation of the popular is-path-inside npm package, designed to help prevent path-traversal vulnerabilities.
spotlighting-datamarking - spotlighting-datamarking provides a lightweight implementation of the Spotlighting paper’s techniques, offering data delimiting, datamarking, and optional Base64 encoding to help separate data from instructions and reduce susceptibility to indirect prompt-injection attacks.
promptpurify - structural prompt firewall for LLM apps, with a trained classifier for prompt-injection and jailbreak inputs.
Secure Composition
pug-plugin-trusted-types - Pug template plugin makes it easy to securely compose HTML from untrusted inputs and provides CSP & CSRF automagic.
npq - Safely install packages with npm or yarn by auditing them as part of your install process.
snyk - Snyk helps you find, fix and monitor known vulnerabilities in Node.js npm, Ruby and Java dependencies, both on an ad hoc basis and as part of your CI (Build) system.
node-release-lines - Introspection API for Node.js release metadata. Provides information about release lines, their relative status along with details of each release.
auditjs - Audits an NPM package.json file to identify known vulnerabilities using the OSSIndex.
npm-audit - Runs a security audit based on your package.json using npm.
npm-audit-resolver - Manage npm-audit results, including options to ignore specific issues in clear and auditable way.
patch-package - Allows app authors to create fixes for npm dependencies (in node_modules) without forking or waiting for merged PRs, by creating and applying patches.
check-my-headers - Fast and simple way to check any HTTP Headers.
clawsearch-guard - Pre-install security check for AI agent skills and npm packages. Runs Trust Score analysis before installation to detect malicious patterns, data exfiltration, and prompt injection.
is-website-vulnerable - finds publicly known security vulnerabilities in a website's frontend JavaScript libraries.
joi-security - Detect security flaws in Joi validation schemas.
NopPP - No Prototype Pollution - Tiny helper to protect against Prototype Pollution vulnerabilities in your application regardless if they introduced in your own code or in 3rd-party code.
anti-trojan-source - Detect trojan source attacks that employ unicode bidi attacks to inject malicious code.
express-limiter - Rate limiting middleware for Express applications built on redis.
limits - Simple express/connect middleware to set limit to upload size, set request timeout etc.
rate-limiter-flexible - Fast, flexible and friendly rate limiter by key and protection from DDoS and brute force attacks in process Memory, Cluster, Redis, MongoDb, MySQL, PostgreSQL at any scale. Express and Koa examples included.
express-enforces-ssl Enforces SSL for Express based Node.js projects. It is however highly advised that you handle SSL and global HTTP rules in a front proxy.
bourneJSON.parse() drop-in replacement with prototype poisoning protection.
sigcli - Authentication layer for AI agents. Local MITM proxy on 127.0.0.1 intercepts HTTPS and injects credentials (cookies, bearer tokens, custom headers) transparently — AI agents authenticate without ever seeing secrets. AES-256-GCM encrypted storage, browser SSO, 4 auth strategies.
secure-json-parseJSON.parse() drop-in replacement with prototype poisoning protection.
express-brute A brute-force protection middleware for express routes that rate-limits incoming requests, increasing the delay with each request in a fibonacci-like sequence.
ses A shim for Hardened JavaScript, a language mode that mitigates prototype pollution attacks and supports safely confining multiple tenants in a single JavaScript realm, endowing each other with hardened API objects.
lavamoat Mitigates supply chain attacks using ses to confine third-party dependencies and limit their access to host powers based on policies generated by trust-on-first-use static analysis.
moddable Implements Hardened JavaScript as the security model for embedded systems.
is-my-node-vulnerable - package that checks if your Node.js installation is vulnerable to known security vulnerabilities.
@lavamoat/preinstall-always-fail - npm package to assert if preinstall or postinstall scripts are running in your npm or yarn workflows.
FCaptcha - Self-hosted CAPTCHA with behavioral analysis that detects bots, vision AI agents, and headless browsers. Includes Node.js server with SHA-256 proof of work.
are-scripts-enabled - npm package to assert if preinstall or postinstall scripts are running in your npm or yarn workflows.
@w-r-l/verify - Verify cryptographic integrity of WACZ web archive bundles. Checks Ed25519 signatures and RFC 3161 timestamps.
pompelmi - Local-first file upload scanning for Node.js to inspect untrusted files before storage.
verifyfetch - SRI-based integrity verification and resumable downloads for large files. Protects against CDN compromise and supply chain attacks in the browser.
Data Sources
resource - A structured list of all the Node.js versions, the binary builds, the dependencies they include (npm, zlib, openssl) along with their versions, whether the release is a security release and whether it is an LTS.
resource - The nodejs/secuirty-wg GitHub repository maintains a /vuln/core directory with all the CVEs applied to Node.js runtime versions.
Security Incidents
Protestware supply chain security issues
The following is a list of known protestware spanning across other ecosystems too:
event-source-polyfill, Mariusz Nowak and their es5-ext, Evan Jacobs and their styled-components, node-ipc, peacenotwar, nestjs-pino - all with regards to the Russian-Ukraine crisis.
The Open Souce Peace organization maintains a list of identified protestware incidents.
Articles covering the topics around protestware are:
A resource for malicious incidents is BadJS - a repository of malicious JavaScript that has been found in websites, extensions, npm packages, and anywhere else JavaScript lives.
npm zoo is an archive keeping track of the original malicious packages source code for educational purposes.
Educational
Newsletters
Node.js Security newsletter - JavaScript & web security insights, latest security vulnerabilities, hands-on secure code insights, npm ecosystem incidents, Node.js runtime feature updates, Bun and Deno runtime updates, secure coding best practices, malware, malicious packages, and more.
Essential Node.js Security by Liran Tal, 2017 - Hands-on and abundant with source code for a practical guide to Securing Node.js web applications.
Securing Node JS Apps
by Ben Edmunds, 2016 - Learn the security basics that a senior developer usually acquires over years of experience, all condensed down into one quick and easy handbook.
GuardRails - A GitHub App that gives you instant security feedback in your Pull Requests.
NodeSecure - An organization of developers building free and open source JavaScript/Node.js security tools.
Hacking Playground
OWASP NodeGoat - The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.
OWASP Juice Shop - The OWASP Juice Shop is an intentionally insecure webapp for security trainings written entirely in Javascript which encompasses the entire OWASP Top Ten and other severe security flaws.
DomGoat - Client XSS happens when untrusted data from sources ends up in sinks. Information and excercises on different sources, different sinks and example of XSS occuring due to them in the menu on the left-hand side.
Contributing
Found an awesome project, package, article, other type of resources related to Node.js Security? Send me a pull request!
Just follow the guidelines. Thank you!
North Korean Lazarus group targets npm packages is-buffer-validator, yoojae-validator, event-handle-package, array-empty-validator, react-event-dependency, and auth-validator
@rspack/core and @rspack/cli at 400k weekly downloads were compromised due to npm token theft and used to publish malicious packages for monero cryptocurrency mining
coa and rc packages - Popular npm library 'coa' was hijacked today with malicious code injected into it, ephemerally impacting React pipelines around the world
pac-resolver - can enable threat actors on the local network to run arbitrary code within your Node.js process whenever it attempts to make an HTTP request
