Node Security

npm Acquires ^Lift Security and the Node Security Platform

npm Registry Spelunking: Dependencies Referenced by URL

I’ve learned a long time ago that not all security research pans out with a stack of vulnerabilities but every time I venture down a rabbit hole I learn something along the way. This is one of those times.

Announcing nsp 3.0.0

The Node Security team is excited to announce version 3.0.0 of the nsp CLI tool.

Get it by running npm i nsp@next

This release marks the 3rd major iteration of the CLI. While the changes mentioned below may seem minor the entire CLI was…

4 years of Node Security

Today marks the 4th birthday of the Node Security Project. During that time we accomplished a lot, failed more than a few times, and inspired many developers to make security an important part of their discipline. The conversations that I’ve been able to have with many of you at…

Potential DoS using lodash/underscore collection methods over user inputs

JavaScript is a magical language. Functions are objects, and objects can have new properties added on the fly. Compilers optimize the code to run it very fast. Even more magic is available with a single…

The Most Common XSS Vulnerability in React.js Applications

If you’ve copied the renderFullPage…

What Are The Bots Up To On npm?

Last year I had a thought, “who else is downloading and running / testing random modules on npm.” Postulating that there might be bots, build systems or other researchers mass downloading and running modules from npm. I figured it might be an interesting vector to attack…