Using secure packages
The npm packages you use may contain critical security vulnerabilities that could also affect your application. It's not possible to go through every package's code or test each of them separately.
There is a database called Node Security Project that has a list of the most important vulnerable packages. You can use command-line tools such as nsp (https://www.npmjs.com/package/nsp) and requireSafe (https://www.npmjs.com/package/requiresafe) to check the vulnerable dependencies of your application.
You should always keep an eye on the new version releases of the packages that your application is dependent on and update it, as a new release often fixes issues related to security.
Get JavaScript: Moving to ES2015 now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
