ESLint plugin for Node.js security — detects command injection, path traversal, SSRF, zip slip, and weak crypto (MD5/SHA-1, ECB, static IV) in fs, child_process, vm, and crypto.

- https://blog.liftsecurity.io/2014/08/19/Avoid-Command-Injection-Node.js/

Production-grade Runtime Application Self-Protection for Express, Next.js, Firebase, and Supabase. Defends against SQL injection, XSS, path traversal, command injection, bots, brute force, and AI-powered attackers. Powered by SharkVoid.

Open-source vulnerability scanner for your code. Detects SQL injection, XSS, hardcoded secrets, command injection, and more across 20+ languages. Fully offline with zero external API calls.

Strict URL sanitization with security-focused validation

ESLint security rules for Model Context Protocol (MCP) servers — catches SANDWORM_MODE credential harvesting, path traversal, command injection, and CVE patterns at dev time

Security scanner for agent skill files - detects command injection, unsafe file operations, hardcoded secrets, and code injection risks

Safe drop-in replacement for git-clone package, fixing command injection vulnerability (CVE-2022-25900)

Dependency Injection library for JavaScript and TypeScript

Dependency Injection for Node.js. Heavily inspired by AngularJS.

Zero-dependency Web Application Firewall middleware for Node.js / Express — SQL injection, XSS, path traversal, command injection, rate limiting, and more.

Lightweight dependency injection container for JavaScript/TypeScript

Security research PoC: command injection via crafted bin key names in npx

Static security scanner/linter for MCP (Model Context Protocol) servers: detects tool poisoning, prompt-injection surfaces, hardcoded secrets, command injection, and excessive permissions in server source code and tool manifests. CLI + GitHub Action, SARI

A Vite plugin that takes the CSS and adds it to the page through the JS. For those who want a single JS file.

Zen by Aikido is an embedded Application Firewall that autonomously protects Node.js apps against common and critical attacks, provides rate limiting, detects malicious traffic (including bots), and more.

Type safe dependency injection framework for TypeScript

Security module - CVE fixes, input validation, path security

Extremely powerful dependency injection container.

A module for making CLI applications with NestJS. Decorators for running commands and separating out config parsers included. This package works on top of commander.