awesome-nodejs-security
Awesome Node.js Security resources
https://github.com/lirantal/awesome-nodejs-security
Last synced: 17 days ago
JSON representation
-
Articles
- A Roadmap for Node.js Security - nodejs-security/issues/42))
- 10 npm security best practices
- OWASP Cheat Sheet Series - Node.js Security Cheat Sheet
- What is a backdoor? Let’s build one with Node.js
- The Anatomy of a Malicious Package
- Why npm lockfiles can be a security blindspot for injecting malicious modules
- GitHub Actions to securely publish npm packages
- A Tale of (prototype) Poisoning
- Securizing your GitHub org
- Top 11 Node.js security best practices | Sqreen.com
- Research Case Study: Supply Chain Security at Scale – Insights into NPM Account Takeovers
- npm Security Best Practices
- Top 11 Node.js security best practices | Sqreen.com
- Top 11 Node.js security best practices | Sqreen.com
- The Documentation Attack Surface: How npm Libraries Teach Insecure Patterns - Analysis of how popular npm libraries with secure defaults teach insecure patterns in their README examples, covering 4 packages with 180M+ combined weekly downloads.
-
Books
- Secure Your Node.js Web Application: Keep Attackers Out and Users Happy
- Essential Node.js Security - Hands-on and abundant with source code for a practical guide to Securing Node.js web applications.
- Thomas Gentilhomme
- Node.js Secure Coding: Defending Against Command Injection Vulnerabilities
- Node.js Secure Coding: Prevention and Exploitation of Path Traversal Vulnerabilities
- Node.js Secure Coding: Mitigate and Weaponize Code Injection Vulnerabilities
-
CSRF
- csurf - Node.js CSRF protection middleware.
- crumb - CSRF crumb generation and validation for [hapi](https://github.com/hapijs/hapi).
- fastify-csrf - A plugin for adding CSRF protection to [fastify](https://www.fastify.io).
-
Dynamic Application Security Testing
- PurpleTeam - A security regression testing SaaS and CLI, perfect for inserting into your build pipelines. You don’t need to write any tests yourself. purpleteam is smart enough to know how to test, you just need to provide a Job file which tells purpleteam what you want tested.
-
GitHub Actions and CI/CD Security
- New dependencies advisor - GitHub Action adding comments to pull requests with package health information about newly added npm dependencies.
- OpenSSF Scorecard Monitor - Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts.
-
Hacking Playground
- DomGoat - Client XSS happens when untrusted data from sources ends up in sinks. Information and excercises on different sources, different sinks and example of XSS occuring due to them in the menu on the left-hand side.
- OWASP NodeGoat - The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.
-
Input Validation & Output Encoding
- node-esapi - node-esapi is a minimal port of the ESAPI4JS (Enterprise Security API for JavaScript) encoder.
- escape-html - Escape string for use in HTML.
- js-string-escape - Escape any string to be a valid JavaScript string literal between double quotes or single quotes.
- xss-filters - Just sufficient output filtering to prevent XSS!
- data-guardian - data-guardian is a tiny, highly customizable lib which can mask sensitive data in arbitrary entities and can help with [OWASP Protect Data everywhere](https://owasp.org/www-project-proactive-controls/v3/en/c8-protect-data-everywhere).
- DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.
- envalid - Envalid is a small library for validating and accessing environment variables in Node.js.
- validator - An npm library of string validators and sanitizers.
- is-path-inside-secure - is-path-inside-secure is a symlink-aware implementation of the popular [is-path-inside](https://www.npmjs.com/package/is-path-inside) npm package, designed to help prevent path-traversal vulnerabilities.
- spotlighting-datamarking - spotlighting-datamarking provides a lightweight implementation of the [Spotlighting paper’s techniques](https://arxiv.org/abs/2403.14720), offering data delimiting, datamarking, and optional Base64 encoding to help separate data from instructions and reduce susceptibility to indirect prompt-injection attacks.
-
Newsletters
- Node.js Security newsletter - JavaScript & web security insights, latest security vulnerabilities, hands-on secure code insights, npm ecosystem incidents, Node.js runtime feature updates, Bun and Deno runtime updates, secure coding best practices, malware, malicious packages, and more.
-
npm and JavaScript specific security incidents and supply chain security issues
- SC Media
- Sonatype
- Checkmarx
- Darcy Clarke's blog
- Phylum
- bignum npm package - supply-chain-attack-exploits.html), [Checkmarx](https://checkmarx.com/blog/hijacking-s3-buckets-new-attack-technique-exploited-in-the-wild-by-supply-chain-attackers/)
- Vulcan
- Illustria on The Hacker News
- The Hacker News
- phylum
- JFrog
- Louisw Lang on Twitter
- Aqua
- TheHackerNews
- Mend
- darkreading
- GitHub
- Snyk - dependency-confusion-attack-gxm-reference/)
- TheRegister
- Aqua
- Aqua - bug-allowed-attackers-to-distribute.html)
- Checkmarx Security blog
- Snyk advisory for event-source-pollyfill - ext commit](https://github.com/medikoo/es5-ext/commit/28de285ed433b45113f01e4ce7c74e9a356b2af2), [ArsTechnica](https://arstechnica.com/information-technology/2022/03/sabotage-code-added-to-popular-npm-package-wiped-files-in-russia-and-belarus/) |
- Checkmarx Security blog
- TheHackerNews
- TheRecord
- TheRecord
- Bleepingcomputer - found-in-coa-and-rc-two-npm-packages-with-23m-weekly-downloads/), [npm tweet](https://twitter.com/npmjs/status/1456310627362742284), [npm tweet for rc](https://twitter.com/npmjs/status/1456398505832976384). |
- the register
- Cybersecurity and Infrastructure Security Agency (CISA) - parser-js/issues/536), [IOCs](https://twitter.com/BleepinComputer/status/1451964720974635021?s=20), [portswigger](https://portswigger.net/daily-swig/popular-npm-package-ua-parser-js-poisoned-with-cryptomining-password-stealing-malware), [theregister](https://www.theregister.com/2021/10/27/npm_roblox_ransomware) |
- arstechnica.com
- Bleepingcomputer
- zdnet.com - npm-packages-used-to-install-njrat-remote-access-trojan/). |
- sonatype - package-caught-stealing-sensitive-discord-and-browser-files/). |
- zdnet
- zdnet
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Snyk - npm-package-that-walked-away-with-all-your-passwords), [Bleeping Computer](https://www.technadu.com/malicious-package-stealing-user-credentials-npm-repository/77482/) |
- npm - another-malicious-package-found-in-npm-targeting-cryptocurrency-wallets), [komodo announcement](https://komodoplatform.com/update-agama-vulnerability/) |
- github issue - code-found-in-npm-package-event-stream), [snyk's postmortem](https://snyk.io/blog/a-post-mortem-of-the-malicious-event-stream-backdoor), [schneid](https://schneid.io/blog/event-stream-vulnerability-explained/), [intrinsic](https://medium.com/intrinsic/compromised-npm-package-event-stream-d47d08605502), [npm](https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident), [jayden](https://jaydenseric.com/blog/event-stream-compromise), [hillel wayne's postmortem](https://www.hillelwayne.com/post/stamping-on-eventstream/) |
- github issue - for-malicious-package-publishes), [nodesource's postmortem](https://nodesource.com/blog/a-high-level-post-mortem-of-the-eslint-scope-security-incident/), [npm's statement](https://status.npmjs.org/incidents/dn7c1fgrr7ng) |
- GitHub issue - malicious-module-getcookies), [bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/somebody-tried-to-hide-a-backdoor-in-a-popular-javascript-npm-package/), [Snyk’s getcookies vulnerability page](https://snyk.io/vuln/npm:getcookies:20180502), [Hacker News](https://news.ycombinator.com/item?id=16975025) |
- conventional-changelog repository update
- CJ blog on typosquat packages - package-managers/), [bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/javascript-packages-caught-stealing-environment-variables/), [Snyk’s crossenv vulnerability page](https://snyk.io/vuln/npm:crossenv:20170802), [Hacker News](https://news.ycombinator.com/item?id=14901566) |
- left-pad.io - one-programmer-broke-the-internet-by-deleting-a-tiny-piece-of-code). |
- BadJS - a repository of malicious JavaScript that has been found in websites, extensions, npm packages, and anywhere else JavaScript lives.
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Sonatype
- Sonatype
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Socket
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Bleeping Computer
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Adventures in Nodeland
- Sonatype
- landh.tech
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Sonatype
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- stacklok
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Snyk
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Checkmarx Security blog
- zdnet.com - npm-packages-used-to-install-njrat-remote-access-trojan/). |
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Sonatype
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Snyk
- Phylum
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- sonatype
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Mend
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Socket
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
- Socket
- Checkmarx Security blog
- Forbes Lindesay - Maintainer post-mortem - did-is-promise-happen-and-what-can-we-learn-from-it/) |
Programming Languages
Categories
npm and JavaScript specific security incidents and supply chain security issues
270
Security Hardening
28
Static Code Analysis
24
Vulnerabilities and Security Advisories
17
Articles
15
Input Validation & Output Encoding
10
Protestware supply chain security issues
7
Web Framework Hardening
7
Books
6
Roadmaps
6
CSRF
3
Secure Composition
3
Hacking Playground
3
GitHub Actions and CI/CD Security
2
License
1
Dynamic Application Security Testing
1
Research Papers
1
Newsletters
1
Sub Categories
Keywords
security
17
nodejs
11
npm
11
javascript
10
security-tools
5
static-analysis
3
python
3
sast
3
security-audit
3
typescript
3
supply-chain-security
3
vulnerabilities
3
fastify-plugin
3
fastify
3
node
3
devsecops
2
rate-limiting
2
appsec
2
security-scanner
2
lint
2
xss
2
linter
2
pypi
2
csrf
2
module
2
owasp
2
privacy
2
sensor
1
environment
1
check
1
validation
1
vulnerability
1
fastify-library
1
json-parser
1
code-analysis
1
static-code-analysis
1
security-automation
1
code-review
1
gdpr
1
node-security
1
devsecops-tools
1
nodejsscan
1
dataflow
1
compliance
1
code-quality
1
docker
1
heroku
1
nodegoat
1
owasp-top-ten
1
owasp-zap
1