Skip to content
Switch branches/tags

Latest commit

This eliminates a dependency (set-value) that is causing alerts in the
GitHub interface.

When I run jest locally, tests pass but the console seems to indicate
errors. (Or maybe they are part of the test?) However, that happens for
me with a fresh install on current main so if that is in fact a problem,
it is not introduced in this PR.

Git stats


Failed to load latest commit information.
Latest commit message
Commit time

Node.js Security WG Security WG Meetings Security WG Twitter Hashtag GitHub Logo Security Responsible Disclosure

Ecosystem Security Working Group

Table of Contents


The Ecosystem Security Working Group works to improve the security of the Node.js Ecosystem.

Responsibilities include:

  • Work with the Node Security Platform to bring community vulnerability data into the foundation as a shared asset.
  • Ensure the vulnerability data is updated in an efficient and timely manner. For example, ensuring there are well-documented processes for reporting vulnerabilities in community modules.
  • Define and maintain policies and procedures for the coordination of security concerns within the external Node.js open source ecosystem.
  • Offer help to npm package maintainers to fix high-impact security bugs.
  • Maintain and make available data on disclosed security vulnerabilities in:
    • the core Node.js project
    • other projects maintained by the Node.js Foundation technical group
    • the external Node.js open source ecosystem
  • Promote the improvement of security practices within the Node.js ecosystem.
  • Facilitate and promote the expansion of a healthy security service and product provider ecosystem.

This Working Group is not responsible for managing or responding to security reports against Node.js itself. That responsibility remains with the Node.js TSC.

Node.js Bug Bounty Program

The Node.js project engages in an official bug bounty program for security researchers and responsible public disclosures. We have established a first draft of accepted criteria and npm modules and projects that are eligible for monetary reward at Bug Bounty Criteria.

The program is managed through the HackerOne platform at with further details.

Participate in Responsible Security Disclosure

As a module author you can provide your users with security guidelines regarding any exposures and vulnerabilities in your project, based on a responsible disclosure policy document we've already put in place.

You can show your users you take security matters seriously and drive higher confidence by following any of the below suggested actions:

  1. Adding a file in your repository that you can copy&paste from us. Just like having a contribution of code of conduct guidelines, a security guideline will help user or bug hunters with the process of reporting a vulnerability or security concern they would like to share.

  2. Adding our Responsible Security Dislosure badge to your project's README which links to the document.

Current Project Team Members

Emeritus Members

Ecosystem Vulnerability Triage Team

Note that membership in the Ecosystem Security WG does not automatically give access to undisclosed vulnerabilities on HackerOne

Code of Conduct

The Node.js Code of Conduct applies to this WG.

Moderation Policy

The Node.js Moderation Policy applies to this WG.


Node.js Ecosystem Security Working Group





No releases published


No packages published