Using secure packages

The npm packages you use may contain critical security vulnerabilities that could also affect your application. It's not possible to go through every package's code or test each of them separately.

There is a database called Node Security Project that has a list of the most important vulnerable packages. You can use command-line tools such as nsp (https://www.npmjs.com/package/nsp) and requireSafe (https://www.npmjs.com/package/requiresafe) to check the vulnerable dependencies of your application.

You should always keep an eye on the new version releases of the packages that your application is dependent on and update it, as a new release often fixes issues related to security.