Awesome Nodejs Security

ESLint plugin to detect and stop Trojan Source attacks

No description.

A server-side TypeScript and JavaScript library immune to Regular Expression Denial of Service (ReDoS) attacks by using Rust and linear RegEx under the hood. Regolith has a linear worst case time complexity, compared to the default RegExp found in TypeScript and JavaScript, which has an exponential worst case.

Checks filenames to be committed against a library of filename rules to prevent sensitive files in Git

Package verification for npm

Analyze a git source code repository for health signals and project vitals

a hapi CSP plugin

Mitigate security concerns of Dependency Confusion supply chain security risks

An extensible, heuristic-based vulnerability scanning tool for installed npm packages

Fast and simple way to check any HTTP Headers

Detect security flaws in Joi validation schemas (XSS, SQL injection, ...) 🔥

Tiny helper to protect against Prototype Pollution vulnerabilities in your application regardless if they introduced in your own code or in 3rd-party code

A zoo for malicious NPM packages

Security and code-quality ESLint plugins — 477 rules across 30 packages: 272 security rules mapped to CWE + OWASP, 107 quality, 98 React/a11y. ESLint 8.40/9/10 + Oxlint. The lint layer AI-generated code needs.

Tor detect middleware for express

Express middleware to collect Reporting API reports - CSP, COOP, COEP, Permissions-Policy, Document-Policy, NEL, crash, deprecation and intervention reports

Guarantee Node.js disclosed the CVEs after a Security Release

Fix NPM lockfile integrity

CLI tool that scans dependency files for EOL status, CVE risk, and health grade

🛡️ NIS2 Compliance Middleware for Express.js - Forensic logging, active defense, and security headers