awesome-nodejs-security

Security resources

A curated collection of security resources and tools for Node.js applications

Awesome Node.js Security resources

GitHub
3k stars
69 watching
241 forks
last commit: 8 days ago
Linked from 2 awesome lists

cybersecurityhacktoberfestinfosecnodejsowasppentestsecurityvulnerabilitiesweb-security

Tools / Web Framework Hardening
Helmet Helmet helps you secure your Express apps by setting various HTTP headers
koa-helmet koa-helmet helps you secure your Koa apps by setting various HTTP headers
blankie 52 over 1 year ago CSP plugin for
fastify-helmet 408 18 days ago fastify-helmet helps you secure your apps by setting important security headers
nuxt-security 820 7 days ago 🛡 Security Module for Nuxt based on OWASP Top 10 and Helmet
reporting-api 2 about 1 month ago Setup and collect CSP, Reporting API v0 and v1 reports to reliabily parse them to be processed by the user

Tools / GitHub Actions and CI/CD Security
New dependencies advisor GitHub Action adding comments to pull requests with package health information about newly added npm dependencies
OpenSSF Scorecard Monitor Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts

Tools / Static Code Analysis
eslint-plugin-security ESLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human
tslint-plugin-security TSLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human
safe-regex detect potentially catastrophic exponential-time regular expressions by limiting the star height to 1
vuln-regex-detector This module lets you check a regex for vulnerability. In JavaScript, regular expressions (regexes) can be "vulnerable": susceptible to catastrophic backtracking. If your application is used on the client side, this can be a performance issue. On the server side, this can expose you to Regular Expression Denial of Service (REDOS)
git-secrets 12,442 7 months ago Prevents you from committing secrets and credentials into git repositories
DevSkim 910 9 days ago DevSkim is a set of IDE plugins and rules that provide security "linting" capabilities. Also has support for CLI so it can be integrated into CI/CD pipeline
ban-sensitive-files 63 19 days ago Checks filenames to be committed against a library of filename rules to prevent storing sensitive files in Git. Checks some files for sensitive contents (for example authToken inside .npmrc file)
NodeJSScan 2,397 7 days ago A static security code scanner for Node.js applications. Including neat UI that can point where the issue is and how to fix it
NodeSecure CLI 367 9 days ago Node.js CLI that allow you to deeply analyze the dependency tree of a given npm package or a directory
Trust But Verify 58 almost 3 years ago TBV compares an npm package with its source repository to ensure the resulting artifact is the same
lockfile-lint 785 2 months ago lint lockfiles for improved security and trust policies to keep clean from malicious package injection and other insecure configurations
pkgsign 93 over 5 years ago A CLI tool for signing and verifying npm and yarn packages
semgrep Open-source, offline, easy-to-customize static analysis for many languages. Some others on this list (NodeJSScan) use semgrep as their engine
npm-scan 50 over 3 years ago An extensible, heuristic-based vulnerability scanning tool for installed npm packages
js-x-ray 229 20 days ago JavaScript and Node.js SAST scanner capable of detecting various well-known malicious code patterns (Unsafe import, Unsafe stmt, Unsafe RegEx, encoded literals, minified and obfuscated codes)
cspscanner CSP Scanner helps developers and security experts to easily inspect and evaluate a site’s Content Security (CSP)
eslint-plugin-anti-trojan-source 76 almost 2 years ago ESLint plugin to detect and prevent Trojan Source attacks from entering your codebase
sdc-check 139 about 1 year ago Small tool to inform you about potential risks in your project dependencies list
fix-lockfile-integrity 6 6 days ago A CLI tool to fix weak integrity hash (sha1) to a more secure integrity hash (sha512) in your npm lockfile
Bearer 2,040 6 days ago A CLI tool to find and help you fix security and privacy risks in your code according to OWASP Top 10
GuardDog 617 6 days ago GuardDog is a CLI tool to Identify malicious PyPI and npm packages

Tools / Dynamic Application Security Testing
PurpleTeam A security regression testing SaaS and CLI, perfect for inserting into your build pipelines. You don’t need to write any tests yourself. purpleteam is smart enough to know how to test, you just need to provide a Job file which tells purpleteam what you want tested

Tools / Input Validation & Output Encoding
node-esapi node-esapi is a minimal port of the ESAPI4JS (Enterprise Security API for JavaScript) encoder
escape-html Escape string for use in HTML
js-string-escape Escape any string to be a valid JavaScript string literal between double quotes or single quotes
validator 23,127 8 days ago An npm library of string validators and sanitizers
xss-filters Just sufficient output filtering to prevent XSS!
DOMPurify 14,025 6 days ago a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG
envalid 1,386 about 2 months ago Envalid is a small library for validating and accessing environment variables in Node.js
data-guardian data-guardian is a tiny, highly customizable lib which can mask sensitive data in arbitrary entities and can help with

Tools / Secure Composition
pug-plugin-trusted-types Pug template plugin makes it easy to securely compose HTML from untrusted inputs and provides CSP & CSRF
safesql A tagged template ( ) that understands 's & 's query grammar to prevent
sh-template-tag A tagged template ( ) that understands Bash syntax so prevents

Tools / CSRF
csurf Node.js CSRF protection middleware
crumb 171 29 days ago CSRF crumb generation and validation for
fastify-csrf 153 18 days ago A plugin for adding CSRF protection to

Tools / Vulnerabilities and Security Advisories
npq 954 2 months ago Safely install packages with npm or yarn by auditing them as part of your install process
snyk Snyk helps you find, fix and monitor known vulnerabilities in Node.js npm, Ruby and Java dependencies, both on an ad hoc basis and as part of your CI (Build) system
node-release-lines Introspection API for Node.js release metadata. Provides information about release lines, their relative status along with details of each release
auditjs 223 8 days ago Audits an NPM package.json file to identify known vulnerabilities using the
npm-audit Runs a security audit based on your package.json using npm
npm-audit-resolver Manage npm-audit results, including options to ignore specific issues in clear and auditable way
gammaray 104 almost 5 years ago Runs a security audit based on your package.json using the
patch-package Allows app authors to create fixes for npm dependencies (in node_modules) without forking or waiting for merged PRs, by creating and applying patches
check-my-headers 45 over 1 year ago Fast and simple way to check any HTTP Headers
is-website-vulnerable 1,937 2 months ago finds publicly known security vulnerabilities in a website's frontend JavaScript libraries
joi-security 44 5 months ago Detect security flaws in Joi validation schemas
confused 701 3 months ago Tool to check for dependency confusion vulnerabilities in multiple package management systems. See for reference on the reasoning for this tool
nodejs-cve-checker 7 8 months ago A simple tool that validates CVEs were published to NVD after a Node.js Security Release

Tools / Security Hardening
hijagger 286 4 days ago Checks all maintainers of all npm and PyPI packages for hijackable packages through domain re-registration
snync 40 about 2 years ago Mitigate security concerns of Dependency Confusion supply chain security risks
NopPP - No Prototype Pollution 25 about 2 years ago Tiny helper to protect against Prototype Pollution vulnerabilities in your application regardless if they introduced in your own code or in 3rd-party code
anti-trojan-source 47 almost 2 years ago Detect trojan source attacks that employ unicode bidi attacks to inject malicious code
express-limiter Rate limiting middleware for Express applications built on redis
limits Simple express/connect middleware to set limit to upload size, set request timeout etc
rate-limiter-flexible Fast, flexible and friendly rate limiter by key and protection from DDoS and brute force attacks in process Memory, Cluster, Redis, MongoDb, MySQL, PostgreSQL at any scale. Express and Koa examples included
tor-detect-middleware 13 12 months ago Tor detect middleware for express
express-enforces-ssl 194 almost 4 years ago Enforces SSL for Express based Node.js projects. It is however highly advised that you handle SSL and global HTTP rules in a front proxy
bourne 169 29 days ago drop-in replacement with prototype poisoning protection
fastify-rate-limit 501 4 days ago A low overhead rate limiter for your routes
secure-json-parse 225 18 days ago drop-in replacement with prototype poisoning protection
express-brute 564 over 3 years ago A brute-force protection middleware for express routes that rate-limits incoming requests, increasing the delay with each request in a fibonacci-like sequence
allowed-scripts 12 5 months ago Execute allowed lifecycle scripts
ses 829 5 days ago A shim for Hardened JavaScript, a language mode that mitigates prototype pollution attacks and supports safely confining multiple tenants in a single JavaScript realm, endowing each other with hardened API objects
lavamoat 868 6 days ago Mitigates supply chain attacks using to confine third-party dependencies and limit their access to host powers based on policies generated by trust-on-first-use static analysis
moddable Implements Hardened JavaScript as the security model for embedded systems
is-my-node-vulnerable 207 17 days ago package that checks if your Node.js installation is vulnerable to known security vulnerabilities

Data Sources
resource A structured list of all the Node.js versions, the binary builds, the dependencies they include (npm, zlib, openssl) along with their versions, whether the release is a security release and whether it is an LTS
resource 501 22 days ago The GitHub repository maintains a directory with all the CVEs applied to Node.js runtime versions

Security Incidents / Protestware supply chain security issues
PyPI package author of atomicwrites deletes his own code
left-pad
node-ipc , Mariusz Nowak and their , Evan Jacobs and their , , , - all with regards to the Russian-Ukraine crisis
Open Souce Peace 78 over 2 years ago The organization maintains a list of identified protestware incidents
2022's Techcrunch protestware review
2022's Snyk protestware types

Security Incidents / npm and JavaScript specific security incidents and supply chain security issues
sonatype
Snyk
Phylum
https://www.landh.tech/blog/20241028-hidden-supply-chain-links/
Sonatype
Snyk
stacklok
Adventures in Nodeland
Sonatype
landh.tech
Bleeping Computer
Sonatype
Socket
Sonatype
SC Media
Sonatype , Tweets
Checkmarx
Darcy Clarke's blog
Phylum
bignum npm package Supply Chain Attack Exploits Abandoned S3 Buckets to Distribute Malicious Binaries for
The Hacker News ,
Vulcan
Illustria on The Hacker News
The Hacker News
phylum
JFrog
Louisw Lang on Twitter
Aqua
TheHackerNews
Mend
darkreading
GitHub
Snyk ,
TheRegister
Aqua
Aqua ,
Checkmarx Security blog
Snyk advisory for event-source-pollyfill , ,
Snyk blog , ,
Checkmarx Security blog
TheHackerNews
TheRecord
TheRecord
Sonatype
Bleepingcomputer , , ,
the register
Cybersecurity and Infrastructure Security Agency (CISA) , , , ,
arstechnica.com
Twitter
Bleepingcomputer
zdnet.com ,
sonatype ,
zdnet
zdnet
Forbes Lindesay - Maintainer post-mortem ,
Snyk , ,
npm , ,
github issue 2,186 almost 6 years ago , , , , , ,
github issue 125 3 months ago , , , ,
GitHub issue 40,656 6 days ago , , , ,
conventional-changelog repository update 7,848 23 days ago
CJ blog on typosquat packages , , , ,
left-pad.io , ,
BadJS A resource for malicious incidents is - a repository of malicious JavaScript that has been found in websites, extensions, npm packages, and anywhere else JavaScript lives
npm zoo 20 almost 2 years ago is an archive keeping track of the original malicious packages source code for educational purposes

Educational / Newsletters
Node.js Security newsletter JavaScript & web security insights, latest security vulnerabilities, hands-on secure code insights, npm ecosystem incidents, Node.js runtime feature updates, Bun and Deno runtime updates, secure coding best practices, malware, malicious packages, and more

Educational / Articles
A Roadmap for Node.js Security (original domain not available. See )
10 npm security best practices
OWASP Cheat Sheet Series - Node.js Security Cheat Sheet
What is a backdoor? Let’s build one with Node.js
The Anatomy of a Malicious Package
Why npm lockfiles can be a security blindspot for injecting malicious modules
GitHub Actions to securely publish npm packages
Top 11 Node.js security best practices | Sqreen.com
A Tale of (prototype) Poisoning
Securizing your GitHub org

Educational / Research Papers
Deep dive into Visual Studio Code extension security vulnerabilities

Educational / Books
Secure Your Node.js Web Application: Keep Attackers Out and Users Happy by Karl Duuna, 2016
Essential Node.js Security by Liran Tal, 2017 - Hands-on and abundant with source code for a practical guide to Securing Node.js web applications
Securing Node JS Apps by Ben Edmunds, 2016 - Learn the security basics that a senior developer usually acquires over years of experience, all condensed down into one quick and easy handbook
Web Developer Security Toolbox Bundled Node.js and Web Security Books
Thomas Gentilhomme book:
Node.js Secure Coding: Defending Against Command Injection Vulnerabilities
Node.js Secure Coding: Prevention and Exploitation of Path Traversal Vulnerabilities
Node.js Secure Coding: Mitigate and Weaponize Code Injection Vulnerabilities

Educational / Roadmaps
Node.js Developer Roadmap

Companies
Snyk A developer-first solution that automates finding & fixing vulnerabilities in your dependencies
Sqreen Automated security for your web apps - real time application security protection
NodeSource Mission-critical Node.js applications. Provides N|Solid and Node Certified Modules
GuardRails A GitHub App that gives you instant security feedback in your Pull Requests
NodeSecure An organization of developers building free and open source JavaScript/Node.js security tools

Companies / Hacking Playground
OWASP NodeGoat 1,885 5 months ago The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them
OWASP Juice Shop 10,466 10 days ago The OWASP Juice Shop is an intentionally insecure webapp for security trainings written entirely in Javascript which encompasses the entire OWASP Top Ten and other severe security flaws
DomGoat Client XSS happens when untrusted data from sources ends up in sinks. Information and excercises on different sources, different sinks and example of XSS occuring due to them in the menu on the left-hand side

Backlinks from these awesome lists:

More related projects: