Security

12-month change compares the average of the last 4 weeks of downloads with the first 4 weeks of the 52-week series. Gzip size is for the whole package, as measured by Bundlephobia. "-" means the value has not been fetched.

• password-policyA module to check if a password lives up to a policy.
• @mondoohq/xgrepA fast, Semgrep-compatible code scanner written in Go.
• @depup/js-yamlYAML 1.2 parser and serializer (with updated dependencies)
• @agimon-ai/doompi-web-securityShared security primitives for the DoomPi web cockpit: sealed channels and signed bundle manifests for independently trusted verifiers.
• npm-audit-ci-wrapperA wrapper for 'npm audit' which can be configurable for use in a CI/CD tool like Jenkins
• eslint-plugin-secure-codingESLint plugin for secure coding — detects LDAP, XPath, XXE, GraphQL and template injection, unsafe deserialization, ReDoS, missing authentication, and PII in logs.
• pulumi-infisicalA Pulumi provider for managing Infisical secrets management platform, dynamically bridged from the Terraform Infisical provider with support for projects, secrets, identity management, integrations, and access controls.
• @depup/express-validatorExpress middleware for the validator module. (with updated dependencies)
• eslint-plugin-node-securityESLint plugin for Node.js security — detects command injection, path traversal, SSRF, zip slip, and weak crypto (MD5/SHA-1, ECB, static IV) in fs, child_process, vm, and crypto.
• @depup/d3-dsvA parser and formatter for delimiter-separated values, such as CSV and TSV (with updated dependencies)
• @woocommerce/sanitizeWooCommerce HTML sanitization utilities.
• @bun-security-scanner/osvOSV vulnerability scanner for Bun projects
• @chax-at/better-npm-auditReshape into a better npm audit for the community and encourage more people to include security audit into their process.
• @cypress/parse-domainSplits an url into sub-domain, domain and effective top-level-domain
• @tines/appsRuntime SDK for Tines apps which includes typed hooks and helpers for interacting with Tines primitives, downloading files, and in-app routing.
• @phc/pbkdf2Node.JS PBKDF2 password hashing algorithm following the PHC string format
• connect-rolesProvides dynamic roles based authorization for node.js connect and express servers.
• targaryenTest Firebase security rules without connecting to Firebase.
• @twin.org/vault-modelsShared models and factory utilities for consistent vault connector integration
• @endo/check-bundleChecks the integrity of an Endo bundle.
• tslint-config-securityTSLint security rules
• strict-csp-html-webpack-pluginA webpack plugin that adds a hash-based strict CSP to help protect your site against XSS attacks.
• @acpr/rate-limit-postgresqlA PostgreSQL store for the `express-rate-limit` middleware
• social-linksValidate & sanitize social links
• @juspay/yamaPrompts-driven pull-request review agent on NeuroLink: config-driven skills, MCP tools, memory and fallback chains
• sysendCommunication and Synchronization between browser tabs/windows. Works cross-domain.
• eslint-plugin-browser-securityESLint plugin for browser security — detects DOM XSS, postMessage abuse, tokens in localStorage, insecure cookies, clickjacking, mixed content, and CSP gaps.
• unifi-protectA complete implementation of the UniFi Protect API.
• noppNoPP (No Prototype Pollution) – tiny helper to protect against Prototype Pollution vulnerabilities in your application
• skyflow-nodeSkyflow SDK for Node.js
• koas-securityKoas security checks if a request matches the security requirement of an operation. For example, given the following partial OpenAPI document:
• @rbac/rbacBlazing Fast, Zero dependency, Hierarchical Role-Based Access Control for Node.js
• grunt-retireGrunt plugin for retire.
• protect-mcpCedar policy enforcement and signed receipts for AI agent tool calls, guided repository review, bounded coding work and exact human approvals. Built by ScopeBlind.
• blowfish-jsPure Javascript implementation of Blowfish block cipher.
• @nanocollective/prompt-scrub`prompt-scrub` is a small open-source, local-first utility designed to strip identifying content out of prompts and messages before they hit any cloud LLM. It maps your sensitive data (emails, secrets, paths) to stable placeholders, allowing you to rehydr
• webext-base-cssExtremely minimal stylesheet/setup for Web Extensions’ options pages (also dark mode)
• vue-sanitize-directiveVue directive for HTML sanitization.
• @raolin2025/claude-code-nodeNode.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management
• @remnux/mcp-serverMCP server for using the REMnux malware analysis toolkit via AI assistants
• fast-ratelimitFast and efficient in-memory rate-limit for Node, used to alleviate severe DOS attacks.
• safegresPostgres security and performance auditor: RLS, grants and effective-access analysis plus index and policy-cost checks, scored on two independent axes. One connection, no framework.
• @arcjet/guardArcjet Guards SDK — AI guardrails for rate limiting, prompt injection detection, and sensitive info detection
• ubiq-security-fpeUbiq Security, Inc. Format Preserving Encryption functions
• phc-bcryptNode.JS bcrypt password hashing algorithm following the PHC string format
• @varlock/astro-integrationAstro integration to use varlock for .env file loading - adds validation, type-safety, and extra security features
• react-native-themisThemis React Native is a convenient cryptographic library for data protection
• upashUnified API for password hashing algorithms
• @carderne/sandbox-runtimeAnthropic Sandbox Runtime (ASRT) - A general-purpose tool for wrapping security boundaries around arbitrary processes
• @neuralegion/class-sanitizerClass-based sanitization in TypeScript using decorators

• zxcvbn vs @zxcvbn-ts/core
• express-rate-limit vs rate-limiter-flexible