Awesome Nodejs Security

Promise based HTTP client for the browser and node.js

The Secure CommsOS™ for mission-critical operations

String validation

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

The Simple, Secure Framework Developers Trust

Prevents you from committing secrets and credentials into git repositories

Fast Rust-based bundler for the web with a modernized webpack API 🦀

UAParser.js: The Essential Web Development Tool for User-Agent Detection. Detect Browsers, OS, Devices, Bots, Apps, AI Crawlers, and more. Run in Browser or Node

Generate changelogs and release notes from a project's commit messages and metadata.

Static analysis for GitHub Actions (and more)

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

nodejsscan is a static security code scanner for Node.js applications.

EventStream is like functional programming meets IO

The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.

finds publicly known security vulnerabilities in a website's frontend JavaScript libraries

safely install npm packages by auditing them pre-install stage

Environment variable validation for Node, Bun, and other compatible JS runtimes

tools for sandboxing your dependency graph

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages

Endo is a distributed secure JavaScript sandbox, based on SES

DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.

🛡 Automatically configure your app to follow OWASP security patterns and principles by using HTTP Headers and Middleware

Lint an npm or yarn lockfile to analyze and detect security issues

Tool to check for dependency confusion vulnerabilities in multiple package management systems

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.

Ebook - Become a Node.js developer - https://fraxken.github.io/ebook_nodejs/

ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.

A low overhead rate limiter for your routes

Brute-force protection middleware for express routes by rate limiting incoming requests

Node.js Ecosystem Security Working Group

Important security headers for Fastify

JavaScript security CLI that allow you to deeply analyze the dependency tree of a given package or local Node.js project.

package that checks if your Node.js installation is vulnerable to known security vulnerabilities

Checks all maintainers of all NPM and Pypi packages for hijackable packages through domain re-registration

The authentication CLI & Proxy for AI agents. Give agents access, not your credentials.

JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.

JSON.parse() drop-in replacement with prototype poisoning protection

Audits an NPM package.json file to identify known vulnerabilities.

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.

Enforces SSL for Node.js ExpressJS projects

JSON.parse() drop-in replacement with prototype poisoning protection

ECMAScript extensions (with respect to upcoming ECMAScript features)

A fastify csrf plugin

CSRF crumb generation and validation for hapi

Your users download a 4GB AI model, the connection drops at 3.8GB, verifyfetch resumes from 3.8GB and verifies every byte. Drop-in integrity verification for Transformers.js, WebLLM, and any large file in the browser.

Small tool to inform you about potential risks in project dependencies list

eslint-scope: ECMAScript scope analyzer

Node.js vulnerability scanner

A CLI tool for signing and verifying npm and yarn packages.

Detect Glassworm & trojan source attacks that employ unicode bidi attacks to inject malicious code