Awesome Nodejs Security

Promise based HTTP client for the browser and node.js

The Secure CommsOS™ for mission-critical operations

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.

Brute-force protection middleware for express routes by rate limiting incoming requests

The authentication CLI & Proxy for AI agents. Give agents access, not your credentials.

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.

Node.js vulnerability scanner

A server-side TypeScript and JavaScript library immune to Regular Expression Denial of Service (ReDoS) attacks by using Rust and linear RegEx under the hood. Regolith has a linear worst case time complexity, compared to the default RegExp found in TypeScript and JavaScript, which has an exponential worst case.

Security and code-quality ESLint plugins — 477 rules across 30 packages: 272 security rules mapped to CWE + OWASP, 107 quality, 98 React/a11y. ESLint 8.40/9/10 + Oxlint. The lint layer AI-generated code needs.

Express middleware to collect Reporting API reports - CSP, COOP, COEP, Permissions-Policy, Document-Policy, NEL, crash, deprecation and intervention reports

🛡️ NIS2 Compliance Middleware for Express.js - Forensic logging, active defense, and security headers