NodeJS Red-Team Cheat Sheet

A Collection of articles, videos, blogs, talks and other materials on Node.js Security

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks, helping make your website resistant to SSRF attacks when implemented correctly.

My personal study notes for the exam OpenJS Node Services Developer (JSNSD) and LFW212 course labs

Learning path for becoming nodejs developer from zero to hero. These series includes steps to become nodejs developers for beginner to experienced developers

Defensive static analysis and detection engineering for the 2026 Shai-Hulud npm supply-chain campaign: Sigma/YARA rules, IOCs, ATT&CK mapping, and defender guidance.

A multithreaded, (mostly) async mass Node.js vulnerability scanner.

CLI Vulnify - Faz o scan em seus projetos buscando por vulnerabilidades.

This is a set of hacking tools written in NodeJS

SystemGuard - Prozessüberwachung und Firewall-Schutz

TorusGuard is a portable AI-agent skill that helps developers build secure-by-default web applications. It audits and hardens secrets, frontend database exposure, input validation, authentication, authorization, rate limits, CORS, source maps, and production security configuration.

Awesome Node.js Security resources

Secure Node.js e-commerce backend with JWT authentication, refresh token rotation, and protected route middleware.

This project is designed to benchmark the performance of bcrypt hashing at different salt rounds. It helps in determining the optimal number of rounds for hashing passwords, balancing security and performance.

It's a comprehensive Node.js project aimed at implementing a wide range of security measures to ensure robust protection during transmission to safeguarding against common security pitfalls.

Helmet + OWASP Top 10:2025 in one zero-dependency import. Ultra-lightweight security middleware for Node.js

Security Explained in a different way : Nodejs | ReactJs | React Native | Database

PowerShell forensic toolkit for auditing Node.js development environments. Detects npm supply chain attacks, hidden task execution, and obfuscated malware processing.

Zero-dependency detection tools for npm supply chain attacks (Shai-Hulud, CanisterWorm, GlassWorm)