awesome-nodejs-security

Helmet helps you secure your Express apps by setting various HTTP headers

koa-helmet helps you secure your Koa apps by setting various HTTP headers

blankie

CSP plugin for

fastify-helmet

fastify-helmet helps you secure your apps by setting important security headers

nuxt-security

🛡 Security Module for Nuxt based on OWASP Top 10 and Helmet

reporting-api

Setup and collect CSP, Reporting API v0 and v1 reports to reliabily parse them to be processed by the user

GitHub Action adding comments to pull requests with package health information about newly added npm dependencies

Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts

ESLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human

TSLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human

detect potentially catastrophic exponential-time regular expressions by limiting the star height to 1

This module lets you check a regex for vulnerability. In JavaScript, regular expressions (regexes) can be "vulnerable": susceptible to catastrophic backtracking. If your application is used on the client side, this can be a performance issue. On the server side, this can expose you to Regular Expression Denial of Service (REDOS)

git-secrets

Prevents you from committing secrets and credentials into git repositories

DevSkim

DevSkim is a set of IDE plugins and rules that provide security "linting" capabilities. Also has support for CLI so it can be integrated into CI/CD pipeline

ban-sensitive-files

Checks filenames to be committed against a library of filename rules to prevent storing sensitive files in Git. Checks some files for sensitive contents (for example authToken inside .npmrc file)

NodeJSScan

A static security code scanner for Node.js applications. Including neat UI that can point where the issue is and how to fix it

NodeSecure CLI

Node.js CLI that allow you to deeply analyze the dependency tree of a given npm package or a directory

Trust But Verify

TBV compares an npm package with its source repository to ensure the resulting artifact is the same

lockfile-lint

lint lockfiles for improved security and trust policies to keep clean from malicious package injection and other insecure configurations

pkgsign

A CLI tool for signing and verifying npm and yarn packages

Open-source, offline, easy-to-customize static analysis for many languages. Some others on this list (NodeJSScan) use semgrep as their engine

npm-scan

An extensible, heuristic-based vulnerability scanning tool for installed npm packages

js-x-ray

JavaScript and Node.js SAST scanner capable of detecting various well-known malicious code patterns (Unsafe import, Unsafe stmt, Unsafe RegEx, encoded literals, minified and obfuscated codes)

CSP Scanner helps developers and security experts to easily inspect and evaluate a site’s Content Security (CSP)

eslint-plugin-anti-trojan-source

ESLint plugin to detect and prevent Trojan Source attacks from entering your codebase

sdc-check

Small tool to inform you about potential risks in your project dependencies list

fix-lockfile-integrity

A CLI tool to fix weak integrity hash (sha1) to a more secure integrity hash (sha512) in your npm lockfile

Bearer

A CLI tool to find and help you fix security and privacy risks in your code according to OWASP Top 10

GuardDog

GuardDog is a CLI tool to Identify malicious PyPI and npm packages

A security regression testing SaaS and CLI, perfect for inserting into your build pipelines. You don’t need to write any tests yourself. purpleteam is smart enough to know how to test, you just need to provide a Job file which tells purpleteam what you want tested

node-esapi is a minimal port of the ESAPI4JS (Enterprise Security API for JavaScript) encoder

Escape string for use in HTML

Escape any string to be a valid JavaScript string literal between double quotes or single quotes

validator

An npm library of string validators and sanitizers

Just sufficient output filtering to prevent XSS!

DOMPurify

a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG

envalid

Envalid is a small library for validating and accessing environment variables in Node.js

data-guardian is a tiny, highly customizable lib which can mask sensitive data in arbitrary entities and can help with

Pug template plugin makes it easy to securely compose HTML from untrusted inputs and provides CSP & CSRF

A tagged template ( ) that understands 's & 's query grammar to prevent

A tagged template ( ) that understands Bash syntax so prevents

Node.js CSRF protection middleware

crumb

CSRF crumb generation and validation for

fastify-csrf

A plugin for adding CSRF protection to

npq

Safely install packages with npm or yarn by auditing them as part of your install process

Snyk helps you find, fix and monitor known vulnerabilities in Node.js npm, Ruby and Java dependencies, both on an ad hoc basis and as part of your CI (Build) system

Introspection API for Node.js release metadata. Provides information about release lines, their relative status along with details of each release

auditjs

Audits an NPM package.json file to identify known vulnerabilities using the

Runs a security audit based on your package.json using npm

Manage npm-audit results, including options to ignore specific issues in clear and auditable way

gammaray

Runs a security audit based on your package.json using the

Allows app authors to create fixes for npm dependencies (in node_modules) without forking or waiting for merged PRs, by creating and applying patches

check-my-headers

Fast and simple way to check any HTTP Headers

is-website-vulnerable

finds publicly known security vulnerabilities in a website's frontend JavaScript libraries

joi-security

Detect security flaws in Joi validation schemas

confused

Tool to check for dependency confusion vulnerabilities in multiple package management systems. See for reference on the reasoning for this tool

nodejs-cve-checker

A simple tool that validates CVEs were published to NVD after a Node.js Security Release

hijagger

Checks all maintainers of all npm and PyPI packages for hijackable packages through domain re-registration

snync

Mitigate security concerns of Dependency Confusion supply chain security risks

NopPP - No Prototype Pollution

Tiny helper to protect against Prototype Pollution vulnerabilities in your application regardless if they introduced in your own code or in 3rd-party code

anti-trojan-source

Detect trojan source attacks that employ unicode bidi attacks to inject malicious code

Rate limiting middleware for Express applications built on redis

Simple express/connect middleware to set limit to upload size, set request timeout etc

Fast, flexible and friendly rate limiter by key and protection from DDoS and brute force attacks in process Memory, Cluster, Redis, MongoDb, MySQL, PostgreSQL at any scale. Express and Koa examples included

tor-detect-middleware

Tor detect middleware for express

express-enforces-ssl

Enforces SSL for Express based Node.js projects. It is however highly advised that you handle SSL and global HTTP rules in a front proxy

bourne

drop-in replacement with prototype poisoning protection

fastify-rate-limit

A low overhead rate limiter for your routes

secure-json-parse

drop-in replacement with prototype poisoning protection

express-brute

A brute-force protection middleware for express routes that rate-limits incoming requests, increasing the delay with each request in a fibonacci-like sequence

allowed-scripts

Execute allowed lifecycle scripts

ses

A shim for Hardened JavaScript, a language mode that mitigates prototype pollution attacks and supports safely confining multiple tenants in a single JavaScript realm, endowing each other with hardened API objects

lavamoat

Mitigates supply chain attacks using to confine third-party dependencies and limit their access to host powers based on policies generated by trust-on-first-use static analysis

Implements Hardened JavaScript as the security model for embedded systems

is-my-node-vulnerable

package that checks if your Node.js installation is vulnerable to known security vulnerabilities

A structured list of all the Node.js versions, the binary builds, the dependencies they include (npm, zlib, openssl) along with their versions, whether the release is a security release and whether it is an LTS

resource

The GitHub repository maintains a directory with all the CVEs applied to Node.js runtime versions

, Mariusz Nowak and their , Evan Jacobs and their , , , - all with regards to the Russian-Ukraine crisis

Open Souce Peace

The organization maintains a list of identified protestware incidents

, Tweets

Supply Chain Attack Exploits Abandoned S3 Buckets to Distribute Malicious Binaries for

,

,

,

, ,

, ,

, , ,

, , , ,

,

,

,

, ,

, ,

github issue

, , , , , ,

github issue

, , , ,

GitHub issue

, , , ,

, , , ,

, ,

A resource for malicious incidents is - a repository of malicious JavaScript that has been found in websites, extensions, npm packages, and anywhere else JavaScript lives

npm zoo

is an archive keeping track of the original malicious packages source code for educational purposes

JavaScript & web security insights, latest security vulnerabilities, hands-on secure code insights, npm ecosystem incidents, Node.js runtime feature updates, Bun and Deno runtime updates, secure coding best practices, malware, malicious packages, and more

(original domain not available. See )

by Karl Duuna, 2016

by Liran Tal, 2017 - Hands-on and abundant with source code for a practical guide to Securing Node.js web applications

by Ben Edmunds, 2016 - Learn the security basics that a senior developer usually acquires over years of experience, all condensed down into one quick and easy handbook

Bundled Node.js and Web Security Books

book:

A developer-first solution that automates finding & fixing vulnerabilities in your dependencies

Automated security for your web apps - real time application security protection

Mission-critical Node.js applications. Provides N|Solid and Node Certified Modules

A GitHub App that gives you instant security feedback in your Pull Requests

An organization of developers building free and open source JavaScript/Node.js security tools

OWASP NodeGoat

The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them

OWASP Juice Shop

The OWASP Juice Shop is an intentionally insecure webapp for security trainings written entirely in Javascript which encompasses the entire OWASP Top Ten and other severe security flaws

Client XSS happens when untrusted data from sources ends up in sinks. Information and excercises on different sources, different sinks and example of XSS occuring due to them in the menu on the left-hand side