O'Reilly logo

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Patterns in Node Package Vulnerabilities

Book Description

With more than 500 new Node.js packages arriving each day, npm is the world’s largest reusable package registry and the Node ecosystem’s greatest strength. But as the number of detected vulnerabilities continues to rise significantly, the packages themselves are becoming a liability. This ebook shows application developers and penetration testers practical strategies for evaluating and working with today’s npm packages.

Author Chetan Karande (Securing Node Applications) analyzes package vulnerabilities found by security researchers and the Node community, including common coding mistakes behind the most severe and frequently found problems. While the database is by no means comprehensive due to the flood of new packages, these known vulnerabilities still provide a valuable guide to help you conduct a manual code review of npm packages.

You’ll examine the top Node package vulnerabilities, including:

  • Insecure access to the filesystem that leads to directory traversal and symlink attacks
  • Pitfalls that often cause Node developers to inadvertently expose sensitive data
  • Denial-of-service attacks that can prevent legitimate users from accessing your service
  • Cross-site scripting (XSS), a prevalent web application security flaw and frequently occurring vulnerability in Node packages
  • Injection vulnerabilities that enable attackers to obtain, corrupt, or destroy server contents