The Most Common XSS Vulnerability in React.js Applications

If you’ve copied the renderFullPage…

Cross-Site Request Forgery Mitigation for Express.js Apps Made Easy Using The Same-Site Cookie Flag

Express 4.14.0 was just published. With it an update that makes defending against Cross-Site Request Forgery (CSRF) easier. This post will give an overview of…

What Are The Bots Up To On npm?

Last year I had a thought, “who else is downloading and running / testing random modules on npm.” Postulating that there might be bots, build systems or other researchers mass downloading and running modules from npm. I figured it might be an interesting vector to attack…

Regular Expression Denial of Service affecting Express.js

At the end of April I found a flaw in a module that Express and many other frameworks use. This flaw allows a remote attacker to block the event loop of a remote site causing a Denial of Service effectively blocking the site from…

shell-quote Module Leads to Potential Command Injection

What is it

shell-quote is a npm module that allows the user to quote and parse shell commands. This should allow safe use for shell commands, since it should escape all malicious input.

Announcing npm Enterprise Security Add-On

With the explosive growth of Node in the enterprise comes the need for confidence in…

Why you should move from nsp cli to nodesecurity.io?

Removing The Security Chore of Identified Vulnerabilities

This last week we snuck in a new feature to nsp Live; the quick fix security button. This feature intends to remove the chore of figuring out what dependencies you need to update to what versions to fix a particular vulnerability.