The Most Common XSS Vulnerability in React.js Applications

If you’ve copied the renderFullPage…

Cross-Site Request Forgery Mitigation for Express.js Apps Made Easy Using The Same-Site Cookie Flag

Express 4.14.0 was just published. With it an update that makes defending against Cross-Site Request Forgery (CSRF) easier. This post will give an overview of…

What Are The Bots Up To On npm?

Last year I had a thought, “who else is downloading and running / testing random modules on npm.” Postulating that there might be bots, build systems or other researchers mass downloading and running modules from npm. I figured it might be an interesting vector to attack…

Regular Expression Denial of Service affecting Express.js

At the end of April I found a flaw in a module that Express and many other frameworks use. This flaw allows a remote attacker to block the event loop of a remote site causing a Denial of Service effectively blocking the site from…

Potential DoS using lodash/underscore collection methods over user inputs

JavaScript is a magical language. Functions are objects, and objects can have new properties added on the fly. Compilers optimize the code to run it very fast. Even more magic is available with a single…

Announcing nsp 3.0.0

The Node Security team is excited to announce version 3.0.0 of the nsp CLI tool.

Get it by running npm i nsp@next

This release marks the 3rd major iteration of the CLI. While the changes mentioned below may seem minor the entire CLI was…

shell-quote Module Leads to Potential Command Injection

What is it

shell-quote is a npm module that allows the user to quote and parse shell commands. This should allow safe use for shell commands, since it should escape all malicious input.

Announcing npm Enterprise Security Add-On

With the explosive growth of Node in the enterprise comes the need for confidence in…