Security

12-month change compares the average of the last 4 weeks of downloads with the first 4 weeks of the 52-week series. Gzip size is for the whole package, as measured by Bundlephobia. "-" means the value has not been fetched.

• dtrimA tool for trimming deep/lenghty javascript structures. Some potential usages are: debugging, logging or data sanitization.
• @cap.js/widgetThe self-hosted CAPTCHA for the modern web.
• csp-toolkitA comprehensive toolkit for working with Content Security Policy (CSP) directives in TypeScript.
• express-security.txt[](https://travis-ci.org/gergelyke/express-security.txt)
• @hasna/hooksOpen source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command
• express-csp-headerContent-Security-Policy middleware for Express
• @varlock/nextjs-integrationdrop-in replacement for @next/env that uses varlock to load .env files with validation and extra security features
• crypto-toolkit-tsModern Cryptography & Hashing Toolkit - a misuse-resistant, high-level cryptography library for TypeScript/Node.js
• permixPermix is a lightweight, framework-agnostic, type-safe permissions management library for JavaScript applications on the client and server sides.
• sasl-scram-sha-1JavaScript implementation of SCRAM-SHA-1 SASL mechanism.
• sasl-anonymousJavaScript implementation of ANONYMOUS SASL mechanism.
• mlkemAn ML-KEM/CRYSTALS-KYBER implementation written in TypeScript for various JavaScript runtimes
• blitzstrikeBlitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.
• ember-css-urlA helper for safely embedding URLs in style properties
• fold-to-asciiA JavaScript port of the Apache Lucene ASCII Folding Filter that converts alphabetic, numeric, and symbolic Unicode characters which are not in the first 127 ASCII characters (the "Basic Latin" Unicode block) into a ASCII equivalents, if they exist.
• @pulumi/compliance-policies-unit-test-helpersThis repository contains a growing set of Compliance Policies to validate your infrastructure using Pulumi's Crossguard Policy-as-Code framework.
• express-bruteA brute-force protection middleware for express routes that rate limits incoming requests
• @cerbos/hubClient library for interacting with Cerbos Hub from server-side Node.js applications
• @lavamoat/webpackLavaMoat Webpack plugin for running dependencies in Compartments without eval
• csp-typed-directivesProvides type information for all CSP directives and related headers' directives; as well as a basic utility funtion that helps convert the typed properties to the header content's policy string.
• showdown-xss-filterXSS filter extension for showdown
• @siva_raja/uxspUXSP JavaScript/TypeScript Browser SDK
• miscreantMisuse resistant symmetric encryption library providing AES-SIV (RFC 5297), AES-PMAC-SIV, and STREAM constructions
• clamdjsA ClamAV client on node.js
• sanitize-filename-tsSanitize a string for use as a filename
• appattest-checker-nodeNode.JS library to check/verify iOS App Attest attestations & assertions
• express-xss-sanitizerExpress 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack.
• permissions-policyMiddleware to set the Permissions-Policy HTTP header
• vite-plugin-cspCreate CSP meta tags and header configs from all sources in the final Vite html
• @tracespace/xml-idXML ID utilities for tracespace projects
• @nichtsam/helmetHelps secure applications by setting HTTP response headers. Inspired by [`helmet`](https://github.com/helmetjs/helmet) and [`http-helmet`](https://github.com/mcansh/http-helmet).
• utf8-sanitizeA performant zero-dependency utility to clean UTF-8 text, fix mojibake from latin1, verify string length, and sanitize input
• payload-totpAdd an extra security layer to PayloadCMS using a Time-based One-time Password (TOTP).
• ssl-checkerZero-dependency SSL/TLS certificate checker for Node.js — HTTPS, SMTP, IMAP, POP3, FTP via STARTTLS
• is-local-addressStatically check whether a hostname or IP is a local, loopback, private, or link-local address.
• express-sanitizerExpress middleware for the sanitizer module.
• @gotgenes/pi-permission-systemPermission enforcement extension for the Pi coding agent.
• gitleaks-secret-scannerA powerful, intelligent wrapper for the Gitleaks engine that provides accurate and safe secret scanning for local pre-commit hooks and CI/CD pipelines.
• pin-github-actionPin your GitHub Actions to specific versions automatically!
• node-red-contrib-oauth2The node-red-contrib-oauth2 is a Node-RED node that provides an OAuth2 authentication flow. This node uses the OAuth2 protocol to obtain an access token, which can be used to make authenticated API requests.
• got-ssrfProtect Got requests from SSRF
• @socketsecurity/libCore utilities and infrastructure for Socket.dev security tools
• ehbpJavaScript client for Encrypted HTTP Body Protocol (EHBP)
• @mattkrick/sanitize-svga small script to remove script tags from SVGs
• nestjs-doctorThe deterministic NestJS devtool that catches AI mistakes. Static analysis for NestJS with a health score, diagnostics and an interactive report.
• tinfoilTinfoil secure OpenAI client wrapper
• mongo-escapeEscape variables to prevent NoSQL injection in MongoDB
• @barkleapp/css-sanitizerA CSS sanitizer to prevent XSS attacks
• recaptcha2Easy API for Google reCAPTCHA version 2 for Node.js and Express
• decancerA library that removes common unicode confusables/homoglyphs from strings.

• zxcvbn vs @zxcvbn-ts/core
• express-rate-limit vs rate-limiter-flexible