Awesome Nodejs Security

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

Static analysis for GitHub Actions (and more)

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

nodejsscan is a static security code scanner for Node.js applications.

finds publicly known security vulnerabilities in a website's frontend JavaScript libraries

safely install npm packages by auditing them pre-install stage

Endo is a distributed secure JavaScript sandbox, based on SES

DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.

🛡 Automatically configure your app to follow OWASP security patterns and principles by using HTTP Headers and Middleware

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.

ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.

Checks all maintainers of all NPM and Pypi packages for hijackable packages through domain re-registration

JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.

JSON.parse() drop-in replacement with prototype poisoning protection

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.

Your users download a 4GB AI model, the connection drops at 3.8GB, verifyfetch resumes from 3.8GB and verifies every byte. Drop-in integrity verification for Transformers.js, WebLLM, and any large file in the browser.

Small tool to inform you about potential risks in project dependencies list

A server-side TypeScript and JavaScript library immune to Regular Expression Denial of Service (ReDoS) attacks by using Rust and linear RegEx under the hood. Regolith has a linear worst case time complexity, compared to the default RegExp found in TypeScript and JavaScript, which has an exponential worst case.

Checks filenames to be committed against a library of filename rules to prevent sensitive files in Git

Package verification for npm

Detect security flaws in Joi validation schemas (XSS, SQL injection, ...) 🔥

Security and code-quality ESLint plugins — 477 rules across 30 packages: 272 security rules mapped to CWE + OWASP, 107 quality, 98 React/a11y. ESLint 8.40/9/10 + Oxlint. The lint layer AI-generated code needs.

CLI tool that scans dependency files for EOL status, CVE risk, and health grade

🛡️ NIS2 Compliance Middleware for Express.js - Forensic logging, active defense, and security headers