Awesome Nodejs Security

Promise based HTTP client for the browser and node.js

The Simple, Secure Framework Developers Trust

nodejsscan is a static security code scanner for Node.js applications.

The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.

finds publicly known security vulnerabilities in a website's frontend JavaScript libraries

safely install npm packages by auditing them pre-install stage

Environment variable validation for Node, Bun, and other compatible JS runtimes

Lint an npm or yarn lockfile to analyze and detect security issues

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.

ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.

Node.js Ecosystem Security Working Group

JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.

Your users download a 4GB AI model, the connection drops at 3.8GB, verifyfetch resumes from 3.8GB and verifies every byte. Drop-in integrity verification for Transformers.js, WebLLM, and any large file in the browser.

A CLI tool for signing and verifying npm and yarn packages.

Analyze a git source code repository for health signals and project vitals

Security and code-quality ESLint plugins — 477 rules across 30 packages: 272 security rules mapped to CWE + OWASP, 107 quality, 98 React/a11y. ESLint 8.40/9/10 + Oxlint. The lint layer AI-generated code needs.

Express middleware to collect Reporting API reports - CSP, COOP, COEP, Permissions-Policy, Document-Policy, NEL, crash, deprecation and intervention reports

CLI tool that scans dependency files for EOL status, CVE risk, and health grade

🛡️ NIS2 Compliance Middleware for Express.js - Forensic logging, active defense, and security headers