Runtime security guard for DeepSeek Harness (DSH) — blocks command injection, SSRF, credential exfiltration, and destructive operations at runtime.

ESLint plugin for Node.js security — detects command injection, path traversal, SSRF, zip slip, and weak crypto (MD5/SHA-1, ECB, static IV) in fs, child_process, vm, and crypto.

Runtime verification and receipt verification for AI agents — tool-call guardrail, CCS 7-dimension standard, MCP/DSH security scanner, SSRF/command-injection/credential-exfil blocking, Ed25519 signed tamper-evident receipts. Framework-agnostic.

Correctover runtime security for DeepSeek Harness (DSH): CCS 7-dimension verification, command-injection/SSRF/credential-exfil blocking, Ed25519 receipts, audit-first. Install with `dsh plugin add dsh-correctover`.

Security scanner for agent skill files - detects command injection, unsafe file operations, hardcoded secrets, and code injection risks

Middleware RASP de deteccion de amenazas (SQLi, XSS, Path Traversal, Command Injection) para Node.js/Express, con inferencia ONNX (Random Forest + Isolation Forest)

Static pre-install security scanner for MCP (Model Context Protocol) servers — `npx mcpaudit <path>` flags command injection, credential/env exfiltration into LLM-visible output, over-broad filesystem/tool scope and dynamic eval before you wire a server i

Simple WAF Web App Firewall, middleware for Node.js — blocks SQLi, XSS, path traversal, command injection & bots, with a waf-style browser check, framework-agnostic

- https://blog.liftsecurity.io/2014/08/19/Avoid-Command-Injection-Node.js/

Strict URL sanitization with security-focused validation

Security research PoC: command injection via crafted bin key names in npx

Pinelight Labs' open-source AST security scanner + CLI. Run `pinelight scan .` to find SQL injection, XSS, secrets, path traversal, command injection, weak crypto, race conditions, vulnerable dependencies, prototype pollution, and prompt injection in your

Drop-in proxy for MCP clients — lazy-loads tool schemas (60-95% token savings), scans for SSRF and command injection, wraps arguments in Zod types. Zero runtime deps beyond zod.

Production-grade Runtime Application Self-Protection for Express, Next.js, Firebase, and Supabase. Defends against SQL injection, XSS, path traversal, command injection, bots, brute force, and AI-powered attackers. Powered by SharkVoid.

Dependency Injection for Node.js. Heavily inspired by AngularJS.

Lightweight dependency injection container for JavaScript/TypeScript

escape command to prevent command injection vulnerabilities

Dependency Injection library for JavaScript and TypeScript

Plugin-owned human command registry for DeepSeek Harness UI surfaces

Safe drop-in replacement for git-clone package, fixing command injection vulnerability (CVE-2022-25900)