Security

12-month change compares the average of the last 4 weeks of downloads with the first 4 weeks of the 52-week series. Gzip size is for the whole package, as measured by Bundlephobia. "-" means the value has not been fetched.

• retireRetire is a tool for detecting use of vulnerable libraries
• @endo/cache-mapbounded-size caches having WeakMap-compatible methods
• harden-react-markdownA security-focused wrapper for react-markdown that filters URLs based on allowed prefixes
• dns-prefetch-controlMiddleware to set X-DNS-Prefetch-Control header.
• csrf-csrfA utility package to help implement stateless CSRF protection using the Double Submit Cookie Pattern in express.
• ienoopenMiddleware to set `X-Download-Options` header for IE8 security
• expect-ctMiddleware to set the Expect-CT header
• csrf-syncA utility package to help implement stateful CSRF protection using the Synchroniser Token Pattern in express.
• nuxt-security🛡️ Security Module for Nuxt based on HTTP Headers and Middleware
• xss-filtersSecure XSS Filters - Just sufficient output filtering to prevent XSS!
• vue-dompurify-htmlSafe replacement for the v-html directive
• csp-headerContent-Security-Policy header generator
• @tinyhttp/corsCORS middleware for modern Node.js
• sql-escape-stringSimple SQL string escape.
• sri-toolboxSubresource Integrity tools
• local-web-serverA lean, modular web server for rapid full-stack development
• tor-proxy-agentA lightweight Node.js wrapper for routing HTTP(S) traffic through Tor, including optional ControlPort circuit rotation.
• angular-auth-oidc-clientAngular Lib for OpenID Connect & OAuth2
• ember-cli-sriSRI generation for Ember CLI
• @brandonblack/musigJS implementation of MuSig. 1-dependency MuSig key aggregation, tweaking, and signing.
• @cdxgen/safer-execOS-level sandboxing with tracing, auditing, crypto tracing (CBOM), and learning mode for arbitrary binaries.
• altchaPrivacy-first CAPTCHA widget, compliant with global regulations (GDPR/HIPAA/CCPA/LGDP/DPDPA/PIPL) and WCAG accessible. No tracking, self-verifying.
• ssrf-req-filterModule to prevent SSRF when making requests
• @rushstack/eslint-plugin-securityAn ESLint plugin providing rules that identify common security vulnerabilities for browser applications, Node.js tools, and Node.js services
• image-size-nextCommunity-maintained fork of image-size: get dimensions of any image file or buffer. Fixes CVE-2025-71329 and CVE-2025-71330 (DoS via infinite loops).
• secure-web-tokenA secure, encrypted, device-bound authentication token library for Node.js — the best alternative to JWT with AES-256-GCM encryption, device fingerprinting, and true logout support.
• supertokens-websitefrontend sdk for website to be used for auth solution.
• @socketsecurity/bun-security-scannerBun security scanner for SocketDev
• delivery-intelEvidence-driven repo intelligence: DORA metrics, forensic signals, vulnerability scan, and delivery verdict for any GitHub repo. One command, no setup.
• schema-inspectorSchema-Inspector is a powerful tool to sanitize and validate JS objects.
• next-secure-headersSets secure response headers for Next.js.
• @cerbos/coreCommon types used by the Cerbos client libraries
• noseconeProtect your Response with secure headers
• @nosecone/nextProtect your Next.js application with secure headers
• owasp-password-strength-testA password-strength tester based upon the OWASP guidelines for enforcing strong passwords.
• nextjs-corsNextjs-Cors is a node.js package to provide a middleware that can be used to enable CORS with various options in nextjs applications.
• read-envTransform environment variables into JSON object with sanitized values.
• @cerbos/apiGenerated code used by the Cerbos client libraries
• eslint-plugin-redosESLint plugin for catching ReDoS vulnerability
• encrypt-storageWrapper for encrypted localStorage and sessionStorage in browser
• @hackbg/miscreant-esm(ESM port) Misuse resistant symmetric encryption library providing AES-SIV (RFC 5297), AES-PMAC-SIV, and STREAM constructions
• arcjetArcjet runtime security SDK — bot protection, rate limiting, prompt injection detection, PII blocking, and WAF for JavaScript and TypeScript apps
• @socketsecurity/socket-patchCLI tool and schema library for applying security patches to dependencies
• @next-safe/middlewareStrict Content-Security-Policy (CSP) for Next.js with composable middleware
• @arcjet/nextArcjet runtime security SDK for Next.js — bot protection, rate limiting, prompt injection detection, PII blocking, and WAF
• yarn-audit-fixThe missing `yarn audit fix`
• sanitize-s3-objectkeyRemove and replace illegal characters in S3 Object Keys
• @varlock/vite-integrationVite plugin to use varlock for .env file loading - adds validation, type-safety, and extra security features
• npm-audit-resolverAids humans and automation in managing npm audit results
• cross-keychainCross-platform secret storage

• zxcvbn vs @zxcvbn-ts/core
• express-rate-limit vs rate-limiter-flexible