Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

awesome-nodejs-security

Awesome Node.js Security resources
https://github.com/eric-erki/awesome-nodejs-security

Last synced: 4 days ago
JSON representation

  • Web Framework Hardening

    • Helmet - Helmet helps you secure your Express apps by setting various HTTP headers.
    • blankie - CSP plugin for [hapi](https://github.com/hapijs/hapi).

  • Static Code Analysis

    • eslint-plugin-security - ESLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.
    • safe-regex - detect potentially catastrophic exponential-time regular expressions by limiting the star height to 1.
    • vuln-regex-detector - This module lets you check a regex for vulnerability. In JavaScript, regular expressions (regexes) can be "vulnerable": susceptible to catastrophic backtracking. If your application is used on the client side, this can be a performance issue. On the server side, this can expose you to Regular Expression Denial of Service (REDOS).
    • git-secrets - Prevents you from committing secrets and credentials into git repositories.
    • DevSkim - DevSkim is a set of IDE plugins and rules that provide security "linting" capabilities. Also has support for CLI so it can be integrated into CI/CD pipeline.
    • ban-sensitive-files - Checks filenames to be committed against a library of filename rules to prevent storing sensitive files in Git. Checks some files for sensitive contents (for example authToken inside .npmrc file).
    • Trust But Verify - TBV compares an npm package with its source repository to ensure the resulting artifact is the same.
    • lockfile-lint - lint lockfiles for improved security and trust policies to keep clean from malicious package injection and other insecure configurations.
    • NodeJSScan - A static security code scanner for Node.js applications. Including neat UI that can point where the issue is and how to fix it.
    • pkgsign - A CLI tool for signing and verifying npm and yarn packages.
    • NodeJSScan - A static security code scanner for Node.js applications. Including neat UI that can point where the issue is and how to fix it.
    • Nsecure - Node.js CLI that allow you to deeply analyze the dependency tree of a given npm package or a directory.

  • Input Validation & Output Encoding

    • node-esapi - node-esapi is a minimal port of the ESAPI4JS (Enterprise Security API for JavaScript) encoder.
    • escape-html - Escape string for use in HTML.
    • js-string-escape - Escape any string to be a valid JavaScript string literal between double quotes or single quotes.
    • xss-filters - Just sufficient output filtering to prevent XSS!
    • validator - An npm library of string validators and sanitizers.

  • Secure Composition

    • pug-plugin-trusted-types - Pug template plugin makes it easy to securely compose HTML from untrusted inputs and provides CSP & CSRF [automagic](https://www.npmjs.com/package/pug-plugin-trusted-types#hdr-automagic).
    • safesql - A tagged template (<code>mysql\`...\`</code>) that understands [Postgres](https://www.npmjs.com/package/safesql#pg)'s & [MySQL](https://www.npmjs.com/package/safesql#mysql)'s query grammar to prevent [SQL injection](https://www.oreilly.com/library/view/securing-node-applications/9781491982426/ch01.html#idm140399946848800).
    • sh-template-tag - A tagged template (<code>sh\`...\`</code>) that understands Bash syntax so prevents [shell injection](https://www.oreilly.com/library/view/securing-node-applications/9781491982426/ch01.html#idm140399951358480).

  • CSRF

    • csurf - Node.js CSRF protection middleware.
    • crumb - CSRF crumb generation and validation for [hapi](https://github.com/hapijs/hapi).

  • Vulnerabilities and Security Advisories

    • snyk - Snyk helps you find, fix and monitor known vulnerabilities in Node.js npm, Ruby and Java dependencies, both on an ad hoc basis and as part of your CI (Build) system.
    • node-release-lines - Introspection API for Node.js release metadata. Provides information about release lines, their relative status along with details of each release.
    • npm-audit-resolver - Manage npm-audit results, including options to ignore specific issues in clear and auditable way.
    • patch-package - Allows app authors to create fixes for npm dependencies (in node_modules) without forking or waiting for merged PRs, by creating and applying patches.
    • npq - Safely install packages with npm or yarn by auditing them as part of your install process.
    • auditjs - Audits an NPM package.json file to identify known vulnerabilities using the [OSSIndex](https://ossindex.sonatype.org/rest).
    • gammaray - Runs a security audit based on your package.json using the [Node.js Security Working Group vulnerability data](https://github.com/nodejs/security-wg/).
    • auditjs - Audits an NPM package.json file to identify known vulnerabilities using the [OSSIndex](https://ossindex.sonatype.org/rest).

  • Security Hardening

    • express-limiter - Rate limiting middleware for Express applications built on redis.
    • limits - Simple express/connect middleware to set limit to upload size, set request timeout etc.
    • rate-limiter-flexible - Fast, flexible and friendly rate limiter by key and protection from DDoS and brute force attacks in process Memory, Cluster, Redis, MongoDb, MySQL, PostgreSQL at any scale. Express and Koa examples included.
    • [npm - another-malicious-package-found-in-npm-targeting-cryptocurrency-wallets), [[komodo announcement]](https://komodoplatform.com/update-agama-vulnerability/)
    • [github issue - code-found-in-npm-package-event-stream), [[snyk's postmortem]](https://snyk.io/blog/a-post-mortem-of-the-malicious-event-stream-backdoor), [[schneid]](https://schneid.io/blog/event-stream-vulnerability-explained/), [[intrinsic]](https://medium.com/intrinsic/compromised-npm-package-event-stream-d47d08605502), [[npm]](https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident), [[jayden]](https://jaydenseric.com/blog/event-stream-compromise), [[hillel wayne's postmortem]](https://www.hillelwayne.com/post/stamping-on-eventstream/)
    • [github issue - for-malicious-package-publishes), [[nodesource's postmortem]](https://nodesource.com/blog/a-high-level-post-mortem-of-the-eslint-scope-security-incident/), [[npm's statement]](https://status.npmjs.org/incidents/dn7c1fgrr7ng)
    • [GitHub issue
    • [npm
    • [bleepingcomputer.com
    • [Snyk’s getcookies vulnerability page
    • [Hacker News
    • [CJ blog on typosquat packages
    • [Typosquatting research paper
    • [bleepingcomputer.com
    • [Snyk’s crossenv vulnerability page
    • [Hacker News
    • BadJS - a repository of malicious JavaScript that has been found in websites, extensions, npm packages, and anywhere else JavaScript lives.

  • Articles

  • Books

  • Hacking Playground

Programming Languages
JavaScript 7 TypeScript 3 CSS 1 HTML 1 Go 1 C# 1 Shell 1
Categories
Security Hardening 17 Static Code Analysis 12 Vulnerabilities and Security Advisories 8 Input Validation & Output Encoding 5 Books 4 Secure Composition 3 Articles 3 Web Framework Hardening 2 CSRF 2 Hacking Playground 2 License 1
Sub Categories
Keywords
security 5 npm 5 nodejs 4 javascript 4 node 3 vulnerabilities 2 lint 2 linter 2 sensor 1 check 1 visual-studio-extension 1 visual-studio-code-extension 1 lockfile 1 lockfiles 1 sdl 1 yarn 1 command-line-tool 1 package-manager 1 security-audit 1 security-tools 1 docker 1 validator 1 validations 1 validation 1 validate 1 sanitize 1 sanitization 1 input 1 pkgsign 1 package-signing 1 package-management 1 static-analysis 1 security-scanner 1 sast 1 nodejsscan 1 node-security 1 devsecops 1 code-review 1 code-analysis 1 owasp-zap 1 owasp-top-ten 1 nodegoat 1 heroku 1