With more than 500 new Node.js packages arriving each day, npm is the world’s largest reusable package registry and the Node ecosystem’s greatest strength. But as the number of detected vulnerabilities continues to rise significantly, the packages themselves are becoming a liability. This ebook shows application developers and penetration testers practical strategies for evaluating and working with today’s npm packages.
Author Chetan Karande (Securing Node Applications) analyzes package vulnerabilities found by security researchers and the Node community, including common coding mistakes behind the most severe and frequently found problems. While the database is by no means comprehensive due to the flood of new packages, these known vulnerabilities still provide a valuable guide to help you conduct a manual code review of npm packages.
You’ll examine the top Node package vulnerabilities, including: