Security

12-month change compares the average of the last 4 weeks of downloads with the first 4 weeks of the 52-week series. Gzip size is for the whole package, as measured by Bundlephobia. "-" means the value has not been fetched.

• react-sanitized-htmlA React component that will sanitize user-inputted HTML code, using the popular sanitize-html package
• @sp-uvb/vueOfficial Vue.js composables for Universal Verification Broker (UVB)
• @sp-uvb/clientUniversal Verification Broker (UVB) TypeScript/JavaScript SDK
• @jongleberry/vurst-htmlRust + N-API: HTML sanitization, extraction, and boilerstrip.
• @pexxi/fold-to-ascii-tsA JavaScript port of the Apache Lucene ASCII Folding Filter that converts alphabetic, numeric, and symbolic Unicode characters which are not in the first 127 ASCII characters (the "Basic Latin" Unicode block) into a ASCII equivalents, if they exist.
• @keep-lts/xlsxSecurity-maintained drop-in fork of xlsx. Back-ports SheetJS's fixes for CVE-2023-30533 (prototype pollution) and CVE-2024-22363 (ReDoS) onto the frozen npm 0.18.5 baseline. Original API unchanged.
• krb5Kerberos library bindings for Node.js
• @devexpress/eslint-plugin-dx-securityAn ESLint® plugin that detects and mitigates security-related issues for DevExpress projects.
• edge-core-jsEdge account & wallet management library
• strict-cspEnables a hash-based strict Content Security Policy for static HTML files and single page applications.
• @jongleberry/vurst-promptPrompt-injection helper utilities for vurst.
• securityUtility methods for escaping according to OWASP.
• phc-argon2Node.JS Argon2 password hashing algorithm following the PHC string format
• gitleaks-secret-scanner-fixedA powerful, intelligent wrapper for the Gitleaks engine that provides accurate and safe secret scanning for local pre-commit hooks and CI/CD pipelines. Fork with fixed tar vulnerability.
• virgil-sdkVirgil Security Services SDK
• rnsecZero-config security scanner for React Native & Expo apps. Find vulnerabilities with 68 security rules covering Android, iOS, and React Native specific issues.
• @taiga-ui/dompurifyInclusive Angular API for DOMPurify
• openapi-generator-cli🚫 Placeholder to prevent dependency confusion.
• audit-exportPretty export your npm audit output as an offline accessible html page
• npm-audit-plusA wrapper around NPM's built-in audit that adds extra features
• eslint-plugin-security-rulesESLint security rules to help harden your project as early as possible.
• @callstack/react-native-sandboxA component to run multiple React Native instances side-by-side.
• actions-upInteractive CLI tool to update GitHub Actions with SHA pinning or preserved refs
• @solongate/proxyAI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.
• @personnummer/generateGenerate Swedish Personal Identity Numbers
• eslint-plugin-prototype-pollution-security-rulesDetect the use of vulnerable features within some libraries from https://github.com/HoLyVieR/prototype-pollution-nsec18/ that are not yet fixed
• organisationsnummerValidate Swedish organization numbers
• vue-html-secureVue.js 2.x and 3.x plugin to add HTML secure directives v-html-remove, v-html-escape, v-html-safe
• npm-audit-reporter-teamcitygenerate TeamCity code inspections from the output of `npm audit`
• @visulima/redactA library for redacting and masking sensitive data from objects and strings, with support for GDPR compliance, custom rules, and deep object traversal.
• reserved-email-addresses-listList of 1250+ generic, admin, mailer-daemon, and no-reply usernames reserved for security concerns. Made for Forward Email <https//forwardemail.net>.
• bun-scanVulnerability scanner for Bun projects
• ring-client-apiUnofficial API for Ring doorbells, cameras, security alarm system and smart lighting
• content-security-policyMiddleware to add Content-Security-Policy header.
• neosanitizeZero-dependency, isomorphic HTML sanitizer: a fast browser-faithful WHATWG engine (deny-by-default) plus a drop-in sanitize-html-compatible legacy engine.
• perfect-express-sanitizera complete package to control user input data to prevent Cross Site Scripting (XSS) ,Sql injection and no Sql injection attack
• cordova-plugin-secure-storage-echoSecure storage plugin for iOS & Android
• dotenv-diffDetects environment variable issues, usage, and potential security risks.
• axios-error-redactLibrary to redact sensitive information from Axios errors
• @turingpointde/cvss.jsA tiny library to work with cvss vectors
• sensitive-fieldsList of sensitive fields that should be masked, obfuscated, or purged for security purposes
• node-guardGeneral purpose I/O module to add following http headers to keep your webpages securing them from malware attacks. This module can be used with any node http server.
• is-my-node-vulnerablepackage that checks if your Node.js installation is vulnerable to known security vulnerabilities
• nuxt-api-shieldNuxt API Shield - Rate Limiting
• sha1-hulud-scannerSha1-Hulud 2.0 npm supply chain attack scanner - Real-time detection using Koi.ai data
• @presidio-dev/hai-guardrailsA set of guards for LLM Apps
• @varlock/expo-integrationExpo/React Native Babel plugin to use varlock for .env file loading - adds validation, type-safety, and extra security features
• vite-plugin-content-security-policyA Vite plugin for managing Content Security Policy (CSP) headers during development and generating Apache/Nginx configuration files
• @kindspells/astro-shieldAstro integration to enhance your website's security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques.
• @seontechnologies/seon-id-verificationAn advanced SDK for natural person identification through document scanning, facial recognition, designed for secure and efficient user verification.

• zxcvbn vs @zxcvbn-ts/core
• express-rate-limit vs rate-limiter-flexible