Node.js Security: Breaking The Loop
summary
Shows concrete exploits and concrete fixes: demonstrates the rimraf npm sabotage and the validator vs validator.js typo trap, uses NodeGoat to exploit XSS and a MongoDB NoSQL injection that logs in by sending operators, proves Helmet (CSP/STS/X-Frame) stops the XSS demo, reproduces a RegExp DoS that blocks the Node event loop, and runs sneak to find vulnerable transient dependencies and integrate checks into CI. Demos work end to end and include small, actionable fixes (casting, header middleware, safer libs).
AI-written summary · about
