Research / npm security
Research into everyday practice.
The npm security guidance I co-authored became the original basis of OWASP’s npm security cheat sheet.
The original npm security best practices
Juan Picado and I published “10 npm Security Best Practices” on the Snyk blog in February 2019. We brought package publishing, installation behavior, dependency health, and account protection into a practical guide for JavaScript developers.
The work connects common development decisions to security consequences: what enters a published tarball, when install scripts execute, and how dependency changes reach a build.
Adoption by OWASP
The introduction to OWASP’s NPM Security Cheat Sheet states that its list was originally based on that Snyk article. This provides a direct trail from the original guidance to a community-maintained security reference.
The OWASP document has continued to evolve with contributions from its community. The original guidance is one contribution to that evolving community resource.
Continuing the work
I maintain npm-security-best-practices as a practical resource for package-manager security. It covers installation policies, dependency sources, release cooldowns, publishing trust, and safer local development.
This sits alongside my lockfile injection research and tools such as lockfile-lint and npq: research findings translated into checks developers can use in their own workflows.