NodeJS Security & NodeJS Secure Coding's Blog

A copy-paste-ready .npmrc and pnpm-workspace.yaml that actually defends against the supply-chain attacks of 2025 and 2026 — with the threat model behind every directive.

A Command Injection vulnerability has been disclosed in the `willitmerge` npm package that allows attackers to execute arbitrary commands on the host system by leveraging insecure child process execution practices.

A command injection vulnerability exists for this command line tool that is available on the npmjs registry.

Publicly disclosing a Command Injection vulnerability in the `git-q` npm package, which allows attackers to execute arbitrary commands on the host system via unsanitized user input.

A Command Injection vulnerability was discovered in the `git-contributors` npm package that allows attackers to execute arbitrary commands by manipulating the options object passed to the library's API.

A Command Injection vulnerability in the `@fab1o/git` npm package allows attackers to execute arbitrary commands on the host system via unsanitized user input passed to the `exec()` function.

An Argument Injection vulnerability was discovered in the `gits` npm package that could allow attackers to execute arbitrary commands on the host

The git-blame npm package is vulnerable to Argument Injection via the `rev` parameter allowing arbitrary command injection.

MCP Servers are increasingly popular for AI-driven workflows.

Explore unknown npx commands and tips to enhance your Node.js workflow.

How-to setup an isolated Node.js local development environment with VS Code DevContainers and 1Password to keep secrets out of your filesystem and avoid supply chain security incidents like shai-hulud, qix maintainer compromise and others.

The MCP Database Server by ExecuteAutomation had a critical vulnerability that allowed SQL injection attacks, bypassing its "read-only" mode.

Security defaults in AI frameworks are crucial.

The Model Context Protocol (MCP) Server by Xata had a critical vulnerability that allows SQL injection attacks, bypassing its "read-only" mode.

Qix maintainer's npm account was phished and used to publish malicious versions of widely used packages (including `debug` and multiple packages in the `chalk` ecosystem).

SQL read-only bypass vulnerabilities present significant security risks and have been shown to impact real-world MCP servers such as those from Anthropic, and other various open-source MCP server implementations.

This guide focuses on securing the MCP Server against command injection vulnerabilities by replacing the unsafe exec function with execFile.

A security disclosure details an Argument Injection vulnerability in the `ggit` npm package version `2.4.12` and earlier.

A critical access control vulnerability in the Simple PSQL MCP Server allows attackers to bypass read-only restrictions through PostgreSQL function abuse.

A critical vulnerability in `ggit`, an npm package simplifying Git interactions through Node.js promises, exposes a command injection risk.

A critical command injection vulnerability in the Create MCP Server STDIO's port monitoring tool allows attackers to execute arbitrary commands.

A critical command injection vulnerability in the GitHub Kanban MCP Server allows attackers to execute arbitrary commands through GitHub issue management operations.

A severe command injection vulnerability in the iOS Simulator MCP Server allows attackers to execute arbitrary commands through AI agent interactions.

A critical command injection vulnerability has been discovered in the Codehooks MCP Server that allows attackers to execute arbitrary commands on the host system.

Dive into the intricacies of a critical SSRF vulnerability in `safe-axios`, a popular npm package designed to protect against SSRF attacks.

This write-up explores a critical vulnerability within `safe-axios`, an npm package aimed at safeguarding applications from SSRF (Server-Side Request Forgery) attacks.

Dive into a critical SSRF vulnerability in the ssrfcheck npm package, exposing a blind spot in its denylist.

A deep dive into an SSRF bypass vulnerability in the popular npm package `private-ip`.

Lucia started off as an educational project to teach authentication and authorization, then evolved into an SDK, then got archived.

Dive into a critical vulnerability in a popular npm package called `nossrf`.

NPM binary planting is a way to cause dependency confusion within installed executable packages with npx.

A path traversal vulnerability in the files-bucket-server npm package allows attackers to access files outside the intended directory.

Using AI Code assistants powered by LLMs are a great productivity boost, but are they also free from vulnerabilities?

Yet another command injection vulnerability in a Node.js package.

Learn practical SSRF bypass techniques in Node.js, why denylist protections fail, and how to avoid weak URL and IP validation patterns in server-side requests.

Ever wondered how interactive CLI prompts can be a security disaster?

Prisma is a popular type-safe ORM for Node.js but just like all abstractions, it comes at a cost and Prisma Raw Query function may lead to SQL injection if not handled correctly.

A promising Git library turns into a security nightmare when it harbors command injection vulnerabilities.

An in-depth analysis of two critical availability vulnerabilities in the parse-duration npm package, showing how regex patterns can lead to event loop delays and memory crashes in Node.js applications.

Are you using the Nuxt MDC library to render LLM generated content in your Nuxt.js apps?

Analyzing a vulnerability in safe-axios, an npm package designed to safeguard applications from SSRF attacks.

What if I told you that parsing URLs from user input, especially from Markdown content, can be a security risk?

Learn about the npm `ignore-scripts` flag and how to use it to prevent the execution of arbitrary commands from malicious npm packages.

If you are doing security research or just curious about finding npm vulnerabilities, let me share some resources to help you stay up-to-date with the latest security CVEs in the JavaScript ecosystem.

IDOR vulnerabilities are often overlooked but can lead to data exfiltration and exposure of confidential data.

Learn how to use JSON Web Tokens (JWT) securely in your Node.js applications.

Half a dozen secure code review comments and none of them mentioned the potential security vulnerability that exists in the code snippet.

Even if you follow security best practices and choose bcrypt for password hashing you can still get it wrong.

How about a more offensive side of security?

Stop storing secrets in environment variables.