Awesome Nodejs Security

Promise based HTTP client for the browser and node.js

The Secure CommsOS™ for mission-critical operations

String validation

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

The Simple, Secure Framework Developers Trust

Fast Rust-based bundler for the web with a modernized webpack API 🦀

UAParser.js: The Essential Web Development Tool for User-Agent Detection. Detect Browsers, OS, Devices, Bots, Apps, AI Crawlers, and more. Run in Browser or Node

Generate changelogs and release notes from a project's commit messages and metadata.

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

EventStream is like functional programming meets IO

The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.

finds publicly known security vulnerabilities in a website's frontend JavaScript libraries

safely install npm packages by auditing them pre-install stage

Environment variable validation for Node, Bun, and other compatible JS runtimes

tools for sandboxing your dependency graph

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages

Endo is a distributed secure JavaScript sandbox, based on SES

🛡 Automatically configure your app to follow OWASP security patterns and principles by using HTTP Headers and Middleware

Lint an npm or yarn lockfile to analyze and detect security issues

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.

Ebook - Become a Node.js developer - https://fraxken.github.io/ebook_nodejs/

ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.

A low overhead rate limiter for your routes

Brute-force protection middleware for express routes by rate limiting incoming requests

Node.js Ecosystem Security Working Group

Important security headers for Fastify

JavaScript security CLI that allow you to deeply analyze the dependency tree of a given package or local Node.js project.

package that checks if your Node.js installation is vulnerable to known security vulnerabilities

The authentication CLI & Proxy for AI agents. Give agents access, not your credentials.

JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.

JSON.parse() drop-in replacement with prototype poisoning protection

Audits an NPM package.json file to identify known vulnerabilities.

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.

Enforces SSL for Node.js ExpressJS projects

JSON.parse() drop-in replacement with prototype poisoning protection

ECMAScript extensions (with respect to upcoming ECMAScript features)

A fastify csrf plugin

CSRF crumb generation and validation for hapi

Your users download a 4GB AI model, the connection drops at 3.8GB, verifyfetch resumes from 3.8GB and verifies every byte. Drop-in integrity verification for Transformers.js, WebLLM, and any large file in the browser.

Small tool to inform you about potential risks in project dependencies list

eslint-scope: ECMAScript scope analyzer

Node.js vulnerability scanner

A CLI tool for signing and verifying npm and yarn packages.

Detect Glassworm & trojan source attacks that employ unicode bidi attacks to inject malicious code

ESLint plugin to detect and stop Trojan Source attacks

A server-side TypeScript and JavaScript library immune to Regular Expression Denial of Service (ReDoS) attacks by using Rust and linear RegEx under the hood. Regolith has a linear worst case time complexity, compared to the default RegExp found in TypeScript and JavaScript, which has an exponential worst case.

Checks filenames to be committed against a library of filename rules to prevent sensitive files in Git

Package verification for npm

Analyze a git source code repository for health signals and project vitals

a hapi CSP plugin