Security

12-month change compares the average of the last 4 weeks of downloads with the first 4 weeks of the 52-week series. Gzip size is for the whole package, as measured by Bundlephobia. "-" means the value has not been fetched.

• @nodesecure/js-x-rayJavaScript AST XRay analysis
• eslint-plugin-nestjs-securityESLint plugin for NestJS security — detects missing auth guards, missing validation pipes, unthrottled routes, and exposed private fields.
• rollup-plugin-sriAdd subresource integrity tags to all your html files 🔒
• pnpm-policypnpm supply-chain policy for npm maintainers — derive minimumReleaseAge exemptions and build permissions from what you publish
• @phc/argon2Node.JS Argon2 password hashing algorithm following the PHC string format
• @authress/sdkClient SDK for Authress authorization as a service. Provides managed authorization api to secure service resources including user data.
• storage-encryptionEncrypt your client storage (available for TS & JS)
• shugoiShugoi anti-abuse protection — one-line integration for Node.js
• strip-jsStrips out all JavaScript code from some HTML text
• btp-guardBTP v5.4.16 The AI Agent Execution Gateway - Sub-35us In-Process Tool Gating, Autonomous Micro-Escrow & SOC 2 Merkle Receipts
• ethlintLinter to identify and fix Style & Security issues in Solidity
• @zingage/postgres-multi-tenant-idsPostgreSQL IDs for secure multi-tenant applications
• validataType safe data validation and sanitization
• npm-audit-helperHelps you understand your npm audit findings so they're not too overwhelming
• v-sanitizeWhitelist-based HTML sanitizer for Vue.js apps.
• circle-irHigh-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis
• @lehcode/soakpSecure OpenAI Key Proxy (SOAKP) facilitates secure usage of the OpenAI API key through a proxy-like application.
• evm-kms-signerAWS/GCP KMS-based Ethereum signer for viem with enterprise-grade security. Sign transactions and messages using keys stored in AWS or GCP KMS without exposing private keys.
• react-secure-linkA TypeScript compatible, zero dependency React component to avoid security exploits when opening a link in a new tab.
• secure-filtersAnti-XSS filters for security
• ginaMVC framework for Node.js and Bun with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency
• envsitterSafely inspect and match .env secrets without exposing values
• fullcourtdefense-cliFull Court Defense CLI — security scanning for AI agents from your terminal
• supply-chain-guardOpen-source supply-chain security scanner for npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, VS Code extensions, GitHub Actions, IaC and Solana C2. Detects GlassWorm, Shai-Hulud, PPE attacks, dependency confusion and 350+ threat indicators acros
• @neuralegion/cvssThe Common Vulnerability Scoring System ([CVSS](https://www.first.org/cvss/)) [score](https://www.first.org/cvss/specification-document#1-2-Scoring) calculator and validator library written in [TypeScript](https://www.typescriptlang.org/).
• @tslite/sanitizeTSLite sanitize — fail-closed AST guard against sandbox-escape surfaces (constructor/prototype/__proto__, dangerous globals) + own-only runtime member access. DEFENSE IN DEPTH, not a security boundary (see SECURITY.md).
• loopback-component-passportLoopBack passport integration to support third party logins and account linking
• @enclave-vm/astA production-ready AST security guard for JavaScript - validate, protect, and enforce code safety with extensible rules
• auth-virAuth made easy and secure via JWT cookies, CSRF tokens, and password hashing helpers.
• ajv-sanitizerString sanitization with JSON-Schema using Ajv
• @lazy-cjk/str-util-trimTrim whitespace and special characters from strings with customizable options
• @cyberstrike-io/cyberstrikeThe first open-source AI agent built for offensive security. Autonomous pentesting from your terminal.
• depcruise🚫 Placeholder to prevent dependency confusion.
• @b12k/gitleaksThe missing NPM wrapper for Gitleaks
• coap-oscoreA Node.js implementation of OSCORE (Object Security for Constrained RESTful Environments) protocol, providing end-to-end security for IoT applications and other constrained environments using CBOR Object Signing and Encryption.
• create-fastify-appA Fastify application generator
• jsfuzzCoverage Guided Javascript Fuzzer
• yarn-osv-auditAudit Yarn v1 lockfiles against the OSV vulnerability database
• cs-devtestAutomatic Husky + Gitleaks + SonarQube setup for any JS/TS project
• @exortek/express-mongo-sanitizeExpress middleware for NoSQL injection prevention — sanitizes request data
• minixhrsuper simpel and small cross-browser xhr
• gulp-nspA gulp module that runs Node Security check
• @twin.org/vault-connector-hashicorpHashiCorp Vault connector for transit cryptography and KV secret workflows
• strip-htmlstrip html streamingly
• @cedar-policy/mcp-schema-generator-wasmWASM bindings for cedar-policy-mcp-schema-generator, exposing SchemaGenerator to JavaScript/TypeScript.
• credentialEasy password hashing and verification in Node. Protects against brute force, rainbow tables, and timing attacks.
• elysia-xssA plugin for Elysia.js that provides XSS (Cross-Site Scripting) protection by sanitizing request body data.
• isolated-functionRun JavaScript from AI agents, plugins, and workflows in a separate Node.js process with strict safety limits.
• ai-sdk-healHeal broken Vercel AI SDK message arrays before they hit the provider. Fixes orphaned tool calls, missing reasoning signatures, invalid tool names, and other provider rejections.
• agent-jailPortable filesystem sandbox for spawning untrusted subprocesses. One static binary, picks the strongest backend available (uid switch on POSIX, Landlock on Linux 5.13+, or both layered).

• zxcvbn vs @zxcvbn-ts/core
• express-rate-limit vs rate-limiter-flexible