awesome-nodejs-security - Awesome Node.js安全资源

项目说明

<br/>
<di="center">

A curated list of awesome Node.js Security resources.

!#
!#
!#

![liran_tal]()

<br/>

<hr/>

<p>
<a href="
<img alt="Node.js Security" align="center" src=" />
</a>
</p>

!Screenshot 2024-09-12 at 20 14 27

<p>
Learn Node.js Secure Coding techniques and best practices from <a href=" Tal</a>
</p>

</div>
<br/>

Contents

Tools

- Web Framework Hardening
- Static Code Analysis
- Dynamic Application Security Testing
- Input/Output
- Secure Composition
- CSRF
- and Security Ad
- Security Hardening

Data Sources

Security Incidents

Educational

- Hacking Playground
- Articles
- Research Papers
- Books
- Roadmaps

Companies

Tools

Web Framework Hardening

Helmet - Helmet helps you secure your Express apps by setting HTTP headers.

koa-helmet - koa-helmet helps you secure your Koa apps by setting HTTP headers.

blankie - CSP plugin for hapi.

fastify-helmet - fastify-helmet helps you secure your fastify apps by setting important security headers.

nis2-express-middleware - Comprehensi.js middleware for EU NIS2 compliance (logging, acti, and secure defaults).

nuxt-security - 🛡 Security Module for Nuxt based on OWASP Top 10 and Helmet.

reporting-api - Express middleware to collect CSP, COOP/COEP, Permissions-Policy, NEL, crash and deprecation reports (Reporting API v0/v1 and legacy report-uri).

GitHub Actions and CI/CD Security

New dependencies advisor - GitHub Action adding comments to pull requests with package health information about newly added npm dependencies.

OpenSSF Scorecard Monitor - Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts.

Static Code Analysis

eslint-plugin-security - ESLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positi need triage by a human.

tslint-plugin-security - TSLint rules for Node Security. This project will help identify potential security hotspots, but finds a lot of false positi need triage by a human.

safe-regex - detect potentially catastrophic exponential-time regular expressions by limiting the star height to 1.

- This module lets you check a regex for . In Ja, regular expressions (regexes) can be "": susceptible to catastrophic backtracking. If your application is used on the 客户端 side, this can be a performance issue. On the 服务端 side, this can expose you to Regular Expression Denial of Service (REDOS).

regolith - Regex library for TypeScript made to prevent ReDoS attacks I made TypeScript bindings for the Rust Regex library to prevent Regular Expression Denial of Service attacks.

git-secrets - Prevents you from committing secrets and credentials into git repositories.

DevSkim - DevSkim is a set of IDE plugins and rules that provide security "linting" capabilities. Also has support for CLI so it can be integrated into CI/CD pipeline.

ban-sensiti - Checks filenames to be committed against a library of filename rules to prevent storing sensiti in Git. Checks some files for sensiti (for example authToken inside .npmrc file).

NodeJSScan - A static security 代码 scanner for Node.js applications. Including neat UI that can point where the issue is and how to fix it.

NodeSecure CLI - Node.js CLI that allow you to deeply analyze the dependency tree of a given npm package or a directory.

Trust But - TB an npm package with its 源码 repository to ensure the resulting artifact is the same.

lockfile-lint - lint lockfiles for impro and trust policies to keep clean from malicious package injection and other insecure configurations.

pkgsign - A CLI 工具 for signing and npm and yarn packages.

semgrep - Open-源码, offline, easy-to-customize static analysis for many languages. Some others on this list (NodeJSScan) use semgrep as their 引擎.

npm-scan - An extensible, heuristic-based scanning 工具 for installed npm packages.

js-x-ray - Ja and Node.js SAST scanner capable of detecting well-known malicious 代码 patterns (Unsafe import, Unsafe stmt, Unsafe RegEx, encoded literals, minified and obfuscated codes).

cspscanner - CSP Scanner helps de and security experts to easily inspect and e a site’s Content Security (CSP).

eslint-plugin-anti-trojan-源码 - ESLint plugin to detect and prevent Trojan 源码 attacks from entering your codebase.

sdc-check - Small 工具 to inform you about potential risks in your project dependencies list

fix-lockfile-integrity - A CLI 工具 to fix weak integrity hash (sha1) to a more secure integrity hash (sha512) in your npm lockfile.

Bearer - A CLI 工具 to find and help you fix security and privacy risks in your 代码 according to OWASP Top 10.

GuardDog - GuardDog is a CLI 工具 to Identify malicious PyPI and npm packages

repolyze - Analyze a git 源码 代码 repository for health signals and project

Dynamic Application Security Testing

PurpleTeam - A security regression testing SaaS and CLI, perfect for inserting into your build pipelines. You don’t need to write any tests yourself. purpleteam is smart enough to know how to test, you just need to provide a Job file which tells purpleteam what you want tested.

Input & Output Encoding

node-esapi - node-esapi is a minimal port of the ESAPI4JS (Enterprise Security API for Ja) encoder.

escape-html - Escape string for use in HTML.

js-string-escape - Escape any string to be a valid Ja string literal between double quotes or single quotes.

- An npm library of string and sanitizers.

xss-filters - Just sufficient output filtering to prevent XSS!

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

envalid - Envalid is a small library for and accessing en in Node.js.

data-guardian - data-guardian is a tiny, highly customizable lib which can mask sensitive data in arbitrary entities and can help with OWASP Protect Data e.

is-path-inside-secure - is-path-inside-secure is a symlink-aware implementation of the popular is-path-inside npm package, designed to help prevent path-tra .

spotlighting-datamarking - spotlighting-datamarking provides a lightweight implementation of the Spotlighting paper’s techniques, offering data delimiting, datamarking, and optional Base64 encoding to help separate data from instructions and reduce susceptibility to indirect prompt-injection attacks.

promptpurify - structural prompt firewall for LLM apps, with a trained classifier for prompt-injection and jailbreak inputs.

Secure Composition

pug-plugin-trusted-types - Pug template plugin makes it easy to securely compose HTML from untrusted inputs and provides CSP & CSRF automagic.

safesql - A tagged template (<代码>mysql\...\</代码>) that understands Postgres's & MySQL's query grammar to prevent SQL injection.

sh-template-tag - A tagged template (<代码>sh\...\</代码>) that understands Bash syntax so prevents shell injection.

CSRF

csurf - Node.js CSRF protection middleware.

crumb - CSRF crumb generation and for hapi.

fastify-csrf - A plugin for adding CSRF protection to fastify.

and Security Ad

npq - Safely install packages with npm or yarn by auditing them as part of your install process.

snyk - Snyk helps you find, fix and monitor known in Node.js npm, Ruby and Ja, both on an ad hoc basis and as part of your CI (Build) system.

node-release-lines - Introspection API for Node.js release metadata. Provides information about release lines, their relati along with details of each release.

auditjs - Audits an NPM package.json file to identify known using the OSSIndex.

npm-audit - Runs a security audit based on your package.json using npm.

npm-audit-resolver - Manage npm-audit results, including options to ignore specific issues in clear and auditable way.

gammaray - Runs a security audit based on your package.json using the Node.js Security Working Group data.

patch-package - Allows app authors to create fixes for npm dependencies (in node_modules) without forking or waiting for merged PRs, by creating and applying patches.

check-my-headers - Fast and simple way to check any HTTP Headers.

clawsearch-guard - Pre-install security check for AI agent skills and npm packages. Runs Trust Score analysis before installation to detect malicious patterns, data exfiltration, and prompt injection.

is-website- - finds publicly known security in a website's frontend Ja libraries.

joi-security - Detect security flaws in Joi schemas.

confused - 工具 to check for dependency confusion in multiple package management systems. See Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies for reference on the reasoning for this 工具.

nodejs-c - A simple 工具 that CVEs were published to N a Node.js Security Release.

zizmor - Static analysis for GitHub Actions and CI/CD workflows.

releaserun - Scan project dependencies for end-of-life runtimes, known CVEs, and health grades across 300+ products.

CVE PoC Search - Search public GitHub proof-of-concept repositories by C.

c - OWASP Lab Project that scans npm, pnpm, Yarn, and Bun lockfiles locally against the OS, classifies findings as direct or transitive, and generates copy-and-run upgrade commands.

Security Hardening

hijagger - Checks all maintainers of all npm and PyPI packages for hijackable packages through domain re-registration.

snync - Mitigate security concerns of Dependency Confusion supply chain security risks.

NopPP - No Prototype Pollution - Tiny helper to protect against Prototype Pollution in your application regardless if they introduced in your own 代码 or in 3rd-party 代码.

anti-trojan-源码 - Detect trojan 源码 attacks that employ unicode bidi attacks to inject malicious 代码.

express-limiter - Rate limiting middleware for Express applications built on redis.

limits - Simple express/connect middleware to set limit to upload size, set request timeout etc.

rate-limiter-flexible - Fast, flexible and friendly rate limiter by key and protection from DDoS and brute force attacks in process Memory, Cluster, Redis, MongoDb, MySQL, PostgreSQL at any scale. Express and Koa examples included.

tor-detect-middleware Tor detect middleware for express

express-enforces-ssl Enforces SSL for Express based Node.js projects. It is howe advised that you handle SSL and global HTTP rules in a front proxy.

bourne JSON.parse() drop-in replacement with prototype poisoning protection.

sigcli - Authentication layer for AI agents. Local MITM proxy on 127.0.0.1 intercepts HTTPS and injects credentials (cookies, bearer tokens, custom headers) transparently — AI agents authenticate without e secrets. AES-256-GCM encrypted storage, browser SSO, 4 auth strategies.

fastify-rate-limit A low o rate limiter for your routes.

secure-json-parse JSON.parse() drop-in replacement with prototype poisoning protection.

express-brute A brute-force protection middleware for express routes that rate-limits incoming requests, increasing the delay with each request in a fibonacci-like sequence.

allowed-scripts Execute allowed npm install lifecycle scripts.

ses A shim for Hardened Ja, a language mode that mitigates prototype pollution attacks and supports safely confining multiple tenants in a single Ja realm, endowing each other with hardened API objects.

la Mitigates supply chain attacks using ses to confine third-party dependencies and limit their access to host powers based on policies generated by trust-on-first-use static analysis.

moddable Implements Hardened Ja as the security model for embedded systems.

is-my-node- - package that checks if your Node.js installation is to known security .

@la/preinstall-always-fail - npm package to assert if preinstall or postinstall scripts are running in your npm or yarn workflows.

FCaptcha - Self-hosted CAPTCHA with beha analysis that detects bots, AI agents, and headless browsers. Includes Node.js 服务端 with SHA-256 proof of work.

are-scripts-enabled - npm package to assert if preinstall or postinstall scripts are running in your npm or yarn workflows.

@w-r-l/ - cryptographic integrity of WACZ web archi. Checks Ed25519 signatures and RFC 3161 timestamps.

pompelmi - Local-first file upload scanning for Node.js to inspect untrusted files before storage.

- SRI-based integrity and resumable downloads for large files. Protects against CDN compromise and supply chain attacks in the browser.

Data Sources

resource - A structured list of all the Node.js , the binary builds, the dependencies they include (npm, zlib, openssl) along with their , whether the release is a security release and whether it is an LTS.

resource - The nodejs/secuirty-wg GitHub repository maintains a /vuln/core directory with all the C to Node.js runtime .

Security Incidents

Protestware supply chain security issues

The following is a list of known protestware spanning across other ecosystems too:

PyPI package author of atomicwrites deletes his own 代码

left-pad

e, Mariusz Nowak and their es5-ext, E and their styled-components, node-ipc, peacenotwar, nestjs-pino - all with regards to the Russian-Ukraine crisis.

The Open Souce Peace organization maintains a list of identified protestware incidents.

Articles co the topics around protestware are:

2022's Techcrunch protestware review

2022's Snyk protestware types

npm and Ja specific security incidents and supply chain security issues

Collection of security incidents that happened in the Node.js, Ja and npm related communities with supporting articles:

| Date | Name | Reference Links |
|-------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2026 Aug 4 | key, flat-cache and file-entry-cache compromised account takeover, spreading to over 400 packages and publishing malicious that carried valid pro | Snyk, Wiz
| 2026 May 11 | TanStack Npm Packages Compromised campaign | Snyk, StepSecurity, Socket
| 2026 Apr 29 | Bun based Stealer hits SAP @cap-js npm package | Snyk
| 2026 Mar 31 | Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT | Snyk, Axios post-mortem on GitHub issue, Mandaint report on UNC1069 in in Axios compromise
| 2025 Sep 25 | Malicious MCP 服务端 on npm postmark-mcp Harvests Emails | Snyk
| 2025 Sep 15 | Shai-Hulud npm package malware | Snyk, Re, Aikido
| 2025 Sep 8 | Qix maintainer compromised campaign causing malware in debug chalk and many other packages | Snyk
| 2025 Aug 27 | Nx package malicious compromise and AI coding tools weaponization of LLM and agents | Snyk
| 2025 Jul 25 | Toptal packages were compromised leading to GitHub Token theft and systems destroyed | Arstechnica
| 2025 Jul 19 | ESLint Config Prettier maintainers get compromised, spread malware and infect other maintainers too | Snyk, Socket, Safedep
| 2025 Jun 25 | Bea North Korean group drops 35 npm malware packages | Socket
| 2025 Jun 12 | npm package -nati/focus and other -nati namespace packages were found to be malicious | Aikido, Bleeping Computer
| 2025 May 15 | os-info-checker-es6 npm package le unicode steganography in Google calendar as command and control |
| 2025 May 8 | Package rand-user-agent with 45,000 downloads compromised in supply chain attack for malicious RAT | Aikido
| 2025 May 7 | Malicious npm Packages Infect 3,200+ Cursor Users With Backdoor | Socket
| 2025 May 2 | Typosquatting popular .NET, Python and other package names | Socket
| 2025 Apr 15 | Russian hackers typosquat express-exp | Safety
| 2025 Apr 10 | pdf-to-office malicious npm package | Re
| 2025 Apr 5 | North Korean Hackers Deploy Bea Malware via 11 Malicious npm Packages | socket
| 2025 Mar 26 | Malicious packages ethers-pro and ethers-pro | Re
| 2025 Mar 11 | North Korean Lazarus group targets npm packages is-buffer-, yoojae-, e, array-empty-, react-e, and auth- | socket
| 2025 Feb 26 | Malicious Code Hidden in NPM Packages | cycode
| 2025 Jan 14 | npm command confusion | Checkmarx
| 2025 Jan 13 | Typosquatted packages for Chalk and Chokidar harbor backdoor trojans | socket
| 2024 Dec 20 | /core and /cli at 400k weekly downloads were compromised due to npm token theft and used to publish malicious packages for monero cryptocurrency mining | rspack release notes, sonatype, Socket
| 2024 Dec 11 | Malicious npm Package -eslint/eslint-plugin exfiltrates data in typosquatting attack | Socket
| 2024 Dec 3 | Supply Chain Attack Detected in Solana's web3.js Library /web3.js | Socket
| 2024 Nov 12 | "node-request-ip", "request-ip-check" and "request-ip-" are fake IP checker utilities on npm target cryptocurrency and install trojans | sonatype
| 2024 Oct 31 | Lottie Player npm package compromised for crypto 钱包 theft | Snyk
| 2024 Oct 31 | Typosquat campaign targeting Puppeteer, Bignum.js, and some 137 other cryptocurrency libraries | Phylum
| 2024 Oct 28 | Dependency confusion campaign used in an npm supply chain security le to breach Fortune 500 company |
| 2024 Oct 4 | lodasher, them4on, laodasher counterfeit npm packages aimed to backdoor Windows users with a modified AnyDesk binary | Sonatype
| 2024 Jul 16 | string-width-cjs and other Suspicious Maintainer Unveils Threads of npm Supply Chain Attack | Snyk
| 2024 Jul 11 | noblox-ts starjacking and QuasarRAT on npm | stacklok
| 2024 Jun 17 | ua-parser-js switches to AGPL+commercial in "rug pull" move | Ad in Nodeland
| 2024 Jun 11 | cors-parser npm package hides cross-platform backdoor in PNG files | Sonatype
| 2024 Jun 03 | npm regsitry cache poisoning attack | landh.tech
| 2024 Apr 26 | Fake job interviews target de with new Python backdoor | Bleeping Computer
| 2024 Apr 16 | Tea tokens and de abusing OSS infrastructure for monetization | Sonatype
| 2024 Feb 6 | noblox.js-proxy-ser npm Package Masquerades as Noblox.js, Targeting Roblox Users for Data Theft | Socket
| 2024 Jan 25 | npm flooded with 748 packages that store movies | Sonatype
| 2024 Jan 3 | An e package with a registry-wide dependencies prevents from packages to be unpublished | SC Media
| 2023 Dec 14 | Ledger supply chain security attack introducing crypto 盗取器 malware (/connect-kit) | Sonatype, Tweets 1 2 3 4 5 6 7 8
| 2023 Sep 27 | Spoofed Dependabot commits steal GitHub tokens and inject malware to Ja files | Checkmarx
| 2023 Jun 27 | Manifest Confusion - a new publicly disclosed bug with the npm package manager demonstrating package metadata inconsistency | Darcy Clarke's blog
| 2023 Jun 23 | North Korean attackers exploit social engineering and supply chain attacks on npm | Phylum
| 2023 Jun 15 | Supply Chain Attack Exploits Abandoned S3 Buckets to Distribute Malicious Binaries for bignum npm package | The Hacker News, Checkmarx
| 2023 Jun 06 | Recommended packages by ChatGPT may be exploited for supply chain security attack |
| 2023 Feb 16 | Researchers Hijack Popular NPM Package with Millions of Downloads | Illustria on The Hacker News
| 2023 Feb 10 | Researchers Unco Malicious 代码 in PyPI Python Packages, affiliated npm ecosystem e too | The Hacker News
| 2023 Jan 29 | Phylum Identifies 137 Malicious npm Packages | phylum
| 2022 Nov 29 | In npm malware may hide in crafted and bypass npm audit's security checks | JFrog
| 2022 Nov 24 | Phylum team captures captures malicious npm package imagecompress-mini claims to be an image compress 工具 | Louisw Lang on Twitter
| 2022 Oct 12 | Aqua security discovers flaw in npm that allows disclosing of pri hosted npm packages on the registry | Aqua
| 2022 Oct 07 | LofyGang Distributed ~200 Malicious NPM Packages to Steal Credit Card Data | TheHackerNews
| 2022 Sep 23 | Popular Cryptocurrency Exchange dYdX Has Had Its NPM Account Hacked | Mend
| 2022 Jul 29 | malicious packages small-sm, pern-, lifeculer, and proc-title target stealing credit card information and discord tokens | darkreading
| 2022 May 26 | stolen oAuth GitHub tokens lead to npm security breach, compromised user accounts metadata, private packages, and plain-text passwords in logs | GitHub
| 2022 May 24 | malicious npm packages exploiting dependency confusion attacks | Snyk, Snyk
| 2022 May 23 | npm packages hijacked due to expired domains | TheRegister
| 2022 Apr 05 | New npm Flaws Let Attackers Better Target Packages for Account Takeover | Aqua
| 2022 Apr 26 | npm package planting | Aqua, The Hacker News
| 2022 Mar 31 | More protestware from styled-components | Checkmarx Security blog
| 2022 Mar 18 | More protestware from es5-ext and e | Snyk ad for e, es5-ext commit, ArsTechnica |
| 2022 March 16 | peacenotwar module sabotages npm de in the node-ipc package to protest the in of Ukraine | Snyk blog, Darkreading, SC Magazine |
| 2022 Mar 7 | Malicious packages caught exfiltrating data webhook services | Checkmarx Security blog |
| 2022 Feb 22 | 25 Malicious Ja Libraries due to typosquatting attacks | TheHackerNews |
| 2022 Feb 11 | 2,818 npm accounts use email addresses with expired domains | TheRecord |
| 2021 Dec 08 | 17 Ja libraries contained malicious 代码 to collect and steal Discord access tokens and en from users’ computers - | TheRecord |
| 2021 December 01 | The Bladabindi trojan and RAT malware | Sonatype |
| 2021 No 04 | coa and rc packages - Popular npm library 'coa' was hijacked today with malicious 代码 injected into it, ephemerally impacting React pipelines around the world | Bleepingcomputer, the record, npm tweet, npm tweet for rc. |
| 2021 October 27 | noblox.js-proxy and noblox.js - typosquatted npm package that target users of official roblox API and SDK npm package (noblox.js) | the register |
| 2021 October 22 | ua-parser-js - of a popular NPM package named ua-parser-js was found to contain malicious 代码 | Cybersecurity and Infrastructure Security Agency (CISA), github issue, IOCs, portswigger, theregister |
| 2021 September 02 | pac-resolver - can enable threat actors on the local 网络 to run arbitrary 代码 within your Node.js process whenever it attempts to make an HTTP request | arstechnica.com |
| 2021 August 07 | npm package ownership process firing back and exposing potential for supply chain security risks. | Twitter |
| 2021 April 13 | New Linux, macOS malware hidden in fake Browserify NPM package: web-browserify | Bleepingcomputer. |
| 2020 December 02 | jdb.js - db-json.js - malicious npm packages caught installing remote access trojans. | zdnet.com, Bleepingcomputer. |
| 2020 No 09 | discord malicious npm package - Npm package caught stealing sensiti and browser files | sonatype, zdnet. |
| 2020 No 03 | twilio-npm - malicious npm package opens backdoors on programmers' computers. | zdnet |
| 2020 August 29 | fallguys - malicious package stealing sensiti. | zdnet |
| 2020 April 27 | is-promise - one-liner library breaks an ecosystem. | Forbes Lindesay - Maintainer post-mortem, snyk's postmortem |
| 2019 August 22 | bb-builder - malicious package targeting Windows systems to exfiltrate information and send to a remote service. | Snyk, Re Labs, Bleeping Computer |
| 2019 June 05 | EasyDEX-GUI - malicious 代码 found in npm package e. | npm, snyk, komodo announcement |
| 2018 No 27 | e - malicious 代码 found in npm package e. | github issue snyk, snyk's postmortem, schneid, intrinsic, npm, jayden, hillel wayne's postmortem |
| 2018 July 12 | eslint - malicious packages found in npm package eslint-scope and eslint-config-eslint. | github issue, eslint tweet, eslint's postmortem, nodesource's postmortem, npm's statement |
| 2018 May 02 | getcookies - malicious package getcookies gets embedded in higher-le related packages. | GitHub issue, npm, bleepingcomputer.com, Snyk’s getcookies page, Hacker News |
| 2018 Feb 13 | maintainer account with access to con npm package compromised and published malware for 1 day and 11 hours | con repository update
| 2017 August 02 | crossenv - malicious typosquatting package crossen en . | CJ blog on typosquat packages, Typosquatting research paper, bleepingcomputer.com, Snyk’s crossen page, Hacker News |
| 2016 March 22 | left-pad - how one de broke Node, Babel and thousands of projects in 11 lines of Ja. | left-pad.io, The Register, qurtaz. |

Follow-up notes:
* A resource for malicious incidents is BadJS - a repository of malicious Ja that has been found in websites, extensions, npm packages, and anywhere else Ja lives.
* npm zoo is an archi track of the original malicious packages 源码 代码 for educational purposes.

Educational

Newsletters

- Node.js Security newsletter - Ja & web security insights, latest security , hands-on secure 代码 insights, npm ecosystem incidents, Node.js runtime feature updates, Bun and Deno runtime updates, secure coding best practices, malware, malicious packages, and more.

Articles

- A Roadmap for Node.js Security (original domain not a. See #42)
- 10 npm security best practices
- OWASP Cheat Sheet Series - Node.js Security Cheat Sheet
- What is a backdoor? Let’s build one with Node.js
- The Anatomy of a Malicious Package
- Why npm lockfiles can be a security blindspot for injecting malicious modules
- GitHub Actions to securely publish npm packages
- Top 11 Node.js security best practices | Sqreen.com
- A Tale of (prototype) Poisoning
- Securizing your GitHub org
- Research Case Study: Supply Chain Security at Scale – Insights into NPM Account Takeovers
- npm Security Best Practices
- The Documentation Attack Surface: How npm Libraries Teach Insecure Patterns - Analysis of how popular npm libraries with secure defaults teach insecure patterns in their README examples, co 4 packages with 180M+ combined weekly downloads.

Research Papers

- Deep dive into Studio 代码 extension security

Books

Secure Your Node.js Web Application: Keep Attackers Out and Users Happy by Karl Duuna, 2016

Essential Node.js Security by Liran Tal, 2017 - Hands-on and abundant with 源码 代码 for a practical guide to Securing Node.js web applications.

Securing Node JS Apps

by Ben Edmunds, 2016 - Learn the security basics that a senior de usually acquires o of experience, all condensed down into one quick and easy handbook.

Web De Security Toolbox

- Bundled Node.js and Web Security Books.

Thomas Gentilhomme book: Become a Node.js De

Node.js Secure Coding: Defending Against Command Injection

Node.js Secure Coding: Pre and Exploitation of Path Tra

Node.js Secure Coding: Mitigate and Weaponize 代码 Injection

Roadmaps

- Node.js De Roadmap

Companies

Snyk - A de solution that automates finding & fixing in your dependencies.

Datadog ASM - Application security monitoring with real-time threat detection and protection (formerly Sqreen, acquired 2021).

NodeSource - Mission-critical Node.js applications. Provides N|Solid and Node Certified Modules.

GuardRails - A GitHub App that gives you instant security feedback in your Pull Requests.

NodeSecure - An organization of de building free and open 源码 Ja/Node.js security tools.

Hacking Playground

- OWASP NodeGoat - The OWASP NodeGoat project provides an en to learn how OWASP Top 10 security risks apply to web applications de using Node.js and how to effectively address them.
- OWASP Juice Shop - The OWASP Juice Shop is an intentionally insecure webapp for security trainings written entirely in Ja which encompasses the entire OWASP Top Ten and other severe security flaws.
- DomGoat - 客户端 XSS happens when untrusted data from sources ends up in sinks. Information and excercises on different sources, different sinks and example of XSS occuring due to them in the menu on the left-hand side.

Contributing

Found an awesome project, package, article, other type of resources related to Node.js Security? Send me a pull request!
Just follow the guidelines. Thank you!

---
say *hi* on Twitter

License

![CC0]()

项目信息

开发语言：未知

Star 数：3045

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Awesome Node.js Security resources展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。