A curated list of awesome Node.js Security resources.
List inspired by the awesome list thing.
- Security Incidents
Web Framework Hardening
- Helmet - Helmet helps you secure your Express apps by setting various HTTP headers.
- koa-helmet - koa-helmet helps you secure your Koa apps by setting various HTTP headers.
- blankie - CSP plugin for hapi.
- fastify-helmet - fastify-helmet helps you secure your fastify apps by setting important secutiry headers.
- nuxt-security - 🛡 Security Module for Nuxt based on OWASP Top 10 and Helmet.
Static Code Analysis
- eslint-plugin-security - ESLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.
- tslint-plugin-security - TSLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.
- safe-regex - detect potentially catastrophic exponential-time regular expressions by limiting the star height to 1.
- git-secrets - Prevents you from committing secrets and credentials into git repositories.
- DevSkim - DevSkim is a set of IDE plugins and rules that provide security "linting" capabilities. Also has support for CLI so it can be integrated into CI/CD pipeline.
- ban-sensitive-files - Checks filenames to be committed against a library of filename rules to prevent storing sensitive files in Git. Checks some files for sensitive contents (for example authToken inside .npmrc file).
- NodeJSScan - A static security code scanner for Node.js applications. Including neat UI that can point where the issue is and how to fix it.
- NodeSecure CLI - Node.js CLI that allow you to deeply analyze the dependency tree of a given npm package or a directory.
- Trust But Verify - TBV compares an npm package with its source repository to ensure the resulting artifact is the same.
- lockfile-lint - lint lockfiles for improved security and trust policies to keep clean from malicious package injection and other insecure configurations.
- pkgsign - A CLI tool for signing and verifying npm and yarn packages.
- semgrep - Open-source, offline, easy-to-customize static analysis for many languages. Some others on this list (NodeJSScan) use semgrep as their engine.
- npm-scan - An extensible, heuristic-based vulnerability scanning tool for installed npm packages.
- cspscanner - CSP Scanner helps developers and security experts to easily inspect and evaluate a site’s Content Security (CSP).
- eslint-plugin-anti-trojan-source - ESLint plugin to detect and prevent Trojan Source attacks from entering your codebase.
- sdc-check - Small tool to inform you about potential risks in your project dependencies list
- fix-lockfile-integrity - A CLI tool to fix weak integrity hash (sha1) to a more secure integrity hash (sha512) in your npm lockfile.
- Bearer - A CLI tool to find and help you fix security and privacy risks in your code according to OWASP Top 10.
- GuardDog - GuardDog is a CLI tool to Identify malicious PyPI and npm packages
Dynamic Application Security Testing
- PurpleTeam - A security regression testing SaaS and CLI, perfect for inserting into your build pipelines. You don’t need to write any tests yourself. purpleteam is smart enough to know how to test, you just need to provide a Job file which tells purpleteam what you want tested.
Input Validation & Output Encoding
- escape-html - Escape string for use in HTML.
- validator - An npm library of string validators and sanitizers.
- xss-filters - Just sufficient output filtering to prevent XSS!
- DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.
- envalid - Envalid is a small library for validating and accessing environment variables in Node.js.
- data-guardian - data-guardian is a tiny, highly customizable lib which can mask sensitive data in arbitrary entities and can help with OWASP Protect Data everywhere.
- pug-plugin-trusted-types - Pug template plugin makes it easy to securely compose HTML from untrusted inputs and provides CSP & CSRF automagic.
- safesql - A tagged template (
mysql`...`) that understands Postgres's & MySQL's query grammar to prevent SQL injection.
- sh-template-tag - A tagged template (
sh`...`) that understands Bash syntax so prevents shell injection.
- csurf - Node.js CSRF protection middleware.
- crumb - CSRF crumb generation and validation for hapi.
- fastify-csrf - A plugin for adding CSRF protection to fastify.
Vulnerabilities and Security Advisories
- npq - Safely install packages with npm or yarn by auditing them as part of your install process.
- snyk - Snyk helps you find, fix and monitor known vulnerabilities in Node.js npm, Ruby and Java dependencies, both on an ad hoc basis and as part of your CI (Build) system.
- node-release-lines - Introspection API for Node.js release metadata. Provides information about release lines, their relative status along with details of each release.
- auditjs - Audits an NPM package.json file to identify known vulnerabilities using the OSSIndex.
- npm-audit - Runs a security audit based on your package.json using npm.
- npm-audit-resolver - Manage npm-audit results, including options to ignore specific issues in clear and auditable way.
- gammaray - Runs a security audit based on your package.json using the Node.js Security Working Group vulnerability data.
- patch-package - Allows app authors to create fixes for npm dependencies (in node_modules) without forking or waiting for merged PRs, by creating and applying patches.
- check-my-headers - Fast and simple way to check any HTTP Headers.
- joi-security - Detect security flaws in Joi validation schemas.
- confused - Tool to check for dependency confusion vulnerabilities in multiple package management systems. See Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies for reference on the reasoning for this tool.
- hijagger - Checks all maintainers of all npm and PyPI packages for hijackable packages through domain re-registration.
- snync - Mitigate security concerns of Dependency Confusion supply chain security risks.
- NopPP - No Prototype Pollution - Tiny helper to protect against Prototype Pollution vulnerabilities in your application regardless if they introduced in your own code or in 3rd-party code.
- anti-trojan-source - Detect trojan source attacks that employ unicode bidi attacks to inject malicious code.
- express-limiter - Rate limiting middleware for Express applications built on redis.
- limits - Simple express/connect middleware to set limit to upload size, set request timeout etc.
- rate-limiter-flexible - Fast, flexible and friendly rate limiter by key and protection from DDoS and brute force attacks in process Memory, Cluster, Redis, MongoDb, MySQL, PostgreSQL at any scale. Express and Koa examples included.
- tor-detect-middleware Tor detect middleware for express
- express-enforces-ssl Enforces SSL for Express based Node.js projects. It is however highly advised that you handle SSL and global HTTP rules in a front proxy.
JSON.parse()drop-in replacement with prototype poisoning protection.
- fastify-rate-limit A low overhead rate limiter for your routes.
JSON.parse()drop-in replacement with prototype poisoning protection.
- express-brute A brute-force protection middleware for express routes that rate-limits incoming requests, increasing the delay with each request in a fibonacci-like sequence.
- allowed-scripts Execute allowed
npm installlifecycle scripts.
- lavamoat Mitigates supply chain attacks using
sesto confine third-party dependencies and limit their access to host powers based on policies generated by trust-on-first-use static analysis.
Protestware supply chain security issues
The following is a list of known protestware spanning across other ecosystems too:
- PyPI package author of atomicwrites deletes his own code
event-source-polyfill, Mariusz Nowak and their
es5-ext, Evan Jacobs and their
peacenotwar, nestjs-pino - all with regards to the Russian-Ukraine crisis.
- The Open Souce Peace organization maintains a list of identified protestware incidents.
Articles covering the topics around protestware are:
|2023 Jun 27||Manifest Confusion - a new publicly disclosed bug with the npm package manager demonstrating package metadata inconsistency||Darcy Clarke's blog|
|2023 Jun 23||North Korean attackers exploit social engineering and supply chain attacks on npm||Phylum|
|2023 Jun 15||Supply Chain Attack Exploits Abandoned S3 Buckets to Distribute Malicious Binaries for bignum npm package||The Hacker News, Checkmarx|
|2023 Jun 06||Recommended packages by ChatGPT may be exploited for supply chain security attack vector||Vulcan|
|2023 Feb 16||Researchers Hijack Popular NPM Package with Millions of Downloads||Illustria on The Hacker News|
|2023 Feb 10||Researchers Uncover Obfuscated Malicious Code in PyPI Python Packages, affiliated npm ecosystem evidence too||The Hacker News|
|2023 Jan 29||Phylum Identifies 137 Malicious npm Packages||phylum|
|2022 Nov 29||Invisible npm malware may hide in crafted versions and bypass npm audit's security checks||JFrog|
|2022 Nov 24||Phylum team captures captures malicious npm package imagecompress-mini claims to be an image compress tool||Louisw Lang on Twitter|
|2022 Oct 12||Aqua security discovers flaw in npm that allows disclosing of privately hosted npm packages on the registry||Aqua|
|2022 Oct 07||LofyGang Distributed ~200 Malicious NPM Packages to Steal Credit Card Data||TheHackerNews|
|2022 Sep 23||Popular Cryptocurrency Exchange dYdX Has Had Its NPM Account Hacked||Mend|
|2022 Jul 29||malicious packages
|2022 May 26||stolen oAuth GitHub tokens lead to npm security breach, compromised user accounts metadata, private packages, and plain-text passwords in logs||GitHub|
|2022 May 24||malicious npm packages exploiting dependency confusion attacks||Snyk, Snyk|
|2022 May 23||npm packages hijacked due to expired domains||TheRegister|
|2022 April 05||New npm Flaws Let Attackers Better Target Packages for Account Takeover||Aqua|
|2022 April 26||npm package planting||Aqua, The Hacker News|
|2022 March 31||More protestware from
||Checkmarx Security blog|
|2022 March 18||More protestware from
||Snyk advisory for event-source-pollyfill, es5-ext commit, ArsTechnica|
|2022 March 16||
||Snyk blog, Darkreading, SC Magazine|
|2022 March 7||Malicious packages caught exfiltrating data via legit webhook services||Checkmarx Security blog|
|2022 February 11||2,818 npm accounts use email addresses with expired domains||TheRecord|
|2021 November 04||coa and rc packages - Popular npm library 'coa' was hijacked today with malicious code injected into it, ephemerally impacting React pipelines around the world||Bleepingcomputer, the record, npm tweet, npm tweet for rc.|
|2021 October 27||noblox.js-proxy and noblox.js - typosquatted npm package that target users of official roblox API and SDK npm package (noblox.js)||the register|
|2021 October 22||ua-parser-js - Versions of a popular NPM package named ua-parser-js was found to contain malicious code||Cybersecurity and Infrastructure Security Agency (CISA), github issue, IOCs, portswigger, theregister|
|2021 September 02||pac-resolver - can enable threat actors on the local network to run arbitrary code within your Node.js process whenever it attempts to make an HTTP request||arstechnica.com|
|2021 August 07||npm package ownership process firing back and exposing potential vectors for supply chain security risks.|
|2021 April 13||New Linux, macOS malware hidden in fake Browserify NPM package: web-browserify||Bleepingcomputer.|
|2020 December 02||jdb.js - db-json.js - malicious npm packages caught installing remote access trojans.||zdnet.com, Bleepingcomputer.|
|2020 November 09||discord malicious npm package - Npm package caught stealing sensitive Discord and browser files||sonatype, zdnet.|
|2020 November 03||twilio-npm - malicious npm package opens backdoors on programmers' computers.||zdnet|
|2020 August 29||fallguys - malicious package stealing sensitive files.||zdnet|
|2020 April 27||is-promise - one-liner library breaks an ecosystem.||Forbes Lindesay - Maintainer post-mortem, snyk's postmortem|
|2019 August 22||bb-builder - malicious package targeting Windows systems to exfiltrate information and send to a remote service.||Snyk, Reversing Labs, Bleeping Computer|
|2019 June 05||EasyDEX-GUI - malicious code found in npm package event-stream.||npm, snyk, komodo announcement|
|2018 November 27||event-stream - malicious code found in npm package event-stream.||github issue snyk, snyk's postmortem, schneid, intrinsic, npm, jayden, hillel wayne's postmortem|
|2018 July 12||eslint - malicious packages found in npm package eslint-scope and eslint-config-eslint.||github issue, eslint tweet, eslint's postmortem, nodesource's postmortem, npm's statement|
|2018 May 02||getcookies - malicious package getcookies gets embedded in higher-level express related packages.||GitHub issue, npm, bleepingcomputer.com, Snyk’s getcookies vulnerability page, Hacker News|
|2018 Feb 13||maintainer account with access to conventional-changelog npm package compromised and published malware for 1 day and 11 hours||conventional-changelog repository update|
|2017 August 02||crossenv - malicious typosquatting package crossenv steals environment variables.||CJ blog on typosquat packages, Typosquatting research paper, bleepingcomputer.com, Snyk’s crossenv vulnerability page, Hacker News|
- npm zoo is an archive keeping track of the original malicious packages source code for educational purposes.
- OWASP NodeGoat - The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.
- DomGoat - Client XSS happens when untrusted data from sources ends up in sinks. Information and excercises on different sources, different sinks and example of XSS occuring due to them in the menu on the left-hand side.
- A Roadmap for Node.js Security (original domain https://nodesecroadmap.fyi/ not available. See #42)
- 10 npm security best practices
- OWASP Cheat Sheet Series - Node.js Security Cheat Sheet
- What is a backdoor? Let’s build one with Node.js
- The Anatomy of a Malicious Package
- Why npm lockfiles can be a security blindspot for injecting malicious modules
- GitHub Actions to securely publish npm packages
- Top 11 Node.js security best practices | Sqreen.com
- A Tale of (prototype) Poisoning
- Securizing your GitHub org
- Secure Your Node.js Web Application: Keep Attackers Out and Users Happy by Karl Duuna, 2016
- Essential Node.js Security by Liran Tal, 2017 - Hands-on and abundant with source code for a practical guide to Securing Node.js web applications.
- Securing Node JS Apps by Ben Edmunds, 2016 - Learn the security basics that a senior developer usually acquires over years of experience, all condensed down into one quick and easy handbook.
- Web Developer Security Toolbox - Bundled Node.js and Web Security Books.
- Thomas Gentilhomme book: Become a Node.js Developer
- Snyk - A developer-first solution that automates finding & fixing vulnerabilities in your dependencies.
- Sqreen - Automated security for your web apps - real time application security protection.
- NodeSource - Mission-critical Node.js applications. Provides N|Solid and Node Certified Modules.
- GuardRails - A GitHub App that gives you instant security feedback in your Pull Requests.
Found an awesome project, package, article, other type of resources related to Node.js Security? Send me a pull request! Just follow the guidelines. Thank you!
say hi on Twitter