npm security

Securing the npm dependency chain — scanners, registry-layer blocking, advisory data, and how compromised packages actually reach production.

JSONata's critical RCE: one expression opens a shell

supply chain security

JSONata's critical RCE: one expression opens a shell

The patches shipped back in May and July — but the three critical JSONata RCE CVEs only went public on Aug 21, so plenty of teams have been quietly exposed without knowing. Which versions are affected, how to find them in your lockfile, and how to fix it.

Aikido Safe Chain Alternative: Best Options for npm

Aikido Safe Chain Alternative: Best Options for npm

A practical Aikido Safe Chain alternative comparison covering npm malware checks, package-age controls, behavioral analysis, CI, and registry enforcement.

A Tool to Block AI From Installing Malicious npm Packages

A Tool to Block AI From Installing Malicious npm Packages

AI coding agents install hallucinated and slopsquatted npm packages without blinking. Here's how to block AI from installing malicious npm packages at the registry, with two config lines (registry URL and token).

Sonatype Nexus Firewall Alternative for npm

supply chain security

Sonatype Nexus Firewall Alternative for npm

Sonatype Nexus Firewall (Repository Firewall) vs a drop-in npm registry firewall — an honest comparison of detection, cost, and setup, plus how to switch.

Snyk Alternative for npm Supply-Chain Security

Snyk Alternative for npm Supply-Chain Security

Snyk scans and alerts — it doesn't block installs. See how InstallSafe's registry firewall compares to Snyk, Socket, Aikido and Dependabot, and when to use each.

Socket.dev Alternative: Registry-Level npm Security

Socket.dev Alternative: Registry-Level npm Security

Socket.dev is strong at zero-hour behavioral detection — but it scans PRs, not installs. See how InstallSafe's registry firewall, Snyk, and Aikido compare, and when to use each.

The keyv worm ate 400+ npm packages in 90 minutes — check if you're exposed

supply chain security

The keyv worm ate 400+ npm packages in 90 minutes — check if you're exposed

A self-replicating npm worm hit keyv and 400+ packages in 90 minutes, stealing cloud, GitHub, and AI-agent credentials during install. Here's how to check your tree — and why install-time blocking is the only real defense.

npm Vulnerability Scanner: 10 Malware Check Tools (2026)

npm Vulnerability Scanner: 10 Malware Check Tools (2026)

Compare ten npm scanners by advisory coverage, behavioral signals, CI workflow, and registry enforcement—plus a practical malware-check process.