Security

12-month change compares the average of the last 4 weeks of downloads with the first 4 weeks of the 52-week series. Gzip size is for the whole package, as measured by Bundlephobia. "-" means the value has not been fetched.

• audit-resolve-coreCore modules for audit-resolve.json file and logic of its processing
• @aikidosec/firewallZen by Aikido is an embedded Application Firewall that autonomously protects Node.js apps against common and critical attacks, provides rate limiting, detects malicious traffic (including bots), and more.
• @cerbos/grpcClient library for interacting with the Cerbos policy decision point service over gRPC from server-side Node.js applications
• node-app-attestA JavaScript implementation of the App Attest protocol, which checks whether clients connecting to your server are valid instances of your app.
• eslint-plugin-security-nodeCreate a security plugin for node.js
• @zxcvbn-ts/matcher-pwnedHaveIBeenPwned Matcher for zxcvbn-ts
• nspThe Node Security (nodesecurity.io) command line interface
• mongo-sanitizeHelper to sanitize mongodb queries against query selector injections
• @stacksjs/sanitizerA fast, native Bun-powered HTML sanitizer with DOMPurify-like features. Protection against XSS and malicious content.
• @vscode/sandbox-runtimeA general-purpose tool for wrapping security boundaries around arbitrary processes.
• @snyk/protectSnyk protect library and utility
• kcorsCross-Origin Resource Sharing(CORS) for koa
• sveltekit-rate-limiterA modular rate limiter for SvelteKit. Use in password resets, account registration, etc.
• exceljs-hardenedUnofficial security-hardened fork of exceljs, patching known unpatched vulnerabilities in the upstream (unmaintained) project. Not affiliated with the original exceljs maintainers.
• koa-corsCORS middleware for Koa
• @hono-rate-limiter/redis<div align="center">
• personnummerValidate Swedish personal identity numbers
• openzeppelin-soliditySecure Smart Contract library for Solidity
• express-caja-sanitizerAn express middleware inspired from express-sanitizer but additionally sanitizes URL params. It also gives an option to provide a preprocessor function to decide whether a (key, value) pair should be sanitized or not.
• @redactpii/nodeZero dependencies, blazing fast regex-based PII redaction with optional compliance dashboard integration. The modern fork of the abandoned 786k-download library.
• node-esapiOSWASP ESAPI4JS encoders port to node module
• @cerbos/httpClient library for interacting with the Cerbos policy decision point service over HTTP from browser-based applications
• wsemiA support package for web developer.
• anti-trojan-sourceDetect trojan source attacks that employ unicode bidi attacks to inject malicious code
• agent-sanitizerDefend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.
• @humanspeak/svelte-markdownMarkdown and HTML renderer for Svelte 5 — built for rendering streaming AI agent output from Claude Code, ChatGPT, and agentic workflows. XSS-safe defaults, streaming-aware sanitization, token caching, TypeScript types, and Svelte 5 runes.
• @yottameta/yotta-guardianYuandun (元盾) — cross-agent dangerous tool-call guardrail: a deterministic rule engine + pluggable intent verifier (model-agnostic) that evaluates exec/write/edit/read/run/shell calls and provides audit logs. Triggers when an agent is about to run a high-r
• openapi-security-handlerA library to process OpenAPI security definitions in parallel.
• @lavamoat/git-safe-dependenciesOpinionated dependency linter for your git/github dependencies
• eslint-plugin-jam3Jam3 eslint plugin for react
• reproduceValidate a package's reproducibility against it's published repository information.
• hibpAn unofficial TypeScript SDK for the 'Have I been pwned?' service.
• @produtype/coreDeterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.
• vuln-vectsA powerful, flexible CVSS parser, calculator and validator written for JavaScript/TypeScript.
• @pulumi/compliance-policy-managerThis repository contains a growing set of Compliance Policies to validate your infrastructure using Pulumi's Crossguard Policy-as-Code framework.
• @capgo/capacitor-is-rootJailbreak/Root Detection Plugin for Capacitor
• strict-transport-securityMiddleware to add Strict-Transport-Security header.
• react-native-recaptcha-that-works⚛ A reCAPTCHA bridge for React Native that works.
• sasl-plainJavaScript implementation of PLAIN SASL mechanism.
• safe-expr-evalSecure expression evaluator - Drop-in replacement for expr-eval without CVE-2025-12735 vulnerability
• egg-securitysecurity plugin in egg framework
• @dr.pogodin/csurfCSRF token middleware for ExpressJS
• safe-fetchA `fetch()` wrapper that implements Double Submit Cookies CSRF protection.
• @capgo/capacitor-app-attestApp Attest on iOS, Play Integrity on Android, and optional device fraud signals for Capacitor
• postmateA powerful, simple, promise-based postMessage library
• @capgo/capacitor-privacy-screenProtect app content in Android screenshots and obscure the iOS app switcher snapshot.
• egg-jsonpjsonp support for egg
• @earendil-works/gondolinAlpine Linux sandbox for running untrusted code with controlled filesystem and network access
• vite-plugin-csp-guardA Vite plugin that lets SPA applications generate a Content Security Policy (CSP).
• @andersmyrmel/vardLightweight prompt injection detection for LLM applications. Zod-inspired chainable API for prompt security.

• zxcvbn vs @zxcvbn-ts/core
• express-rate-limit vs rate-limiter-flexible