# Avoid The Node.js Security Storm — Liran Tal

Keeping your 3rd party project dependencies secured is such an important task that you can’t under-estimate.

Canonical: https://lirantal.com/blog/avoid-the-node-js-security-storm-b073171a663f

![](/images/blog/1__7YJdHaMPzJTjC2yNboShKg.jpeg)

Keeping your 3rd party project dependencies secured is such an important task that you can’t under-estimate.

[Snyk](https://www.snyk.io) is a great tool for monitoring and tracking security vulnerabilities within your Node.js dependencies (and their dependencies).

It’s a stand-alone tool, a platform, and also an active community of security researchers who provide you with patches to insecure code until an upstream package will get an update. This is extremely valuable as you don’t have to wait until an update is made to a package, or just if you don’t want to upgrade to new, possibly breaking features, and get patched the security hole.

### Test for Vulnerabilities

Install snyk as a global dependency so you can set it to monitor your project through snyk’s own dashboard.

Installing snyk:

```
npm install -i snyk
```

Next up, running ***snyk test*** in your project will check **all** dependencies in your project:

![](/images/blog/1__sdkfOee18Y__03qIDE__R5tQ.png)

Luckily I don’t have any vulnerabilities :-)

### Monitoring your GitHub projects

Login to your [snyk.io](https://snyk.io/) account and browse to the Projects area.
There you should locate a *Test my GitHub repositories* button on the right side, just click it:

![](/images/blog/1__kAsN__gffTOqIKRibtKhQnA.png)

Your GitHub repositories will then show up and you can click on the *Watch* button to start tracking them, getting notifications on insecure vulnerabilities found there:

![](/images/blog/1__zO1RXYVep30UTFZoN__EX9Q.png)

### Monitoring your project from the CLI

This is useful as you track the project with every change that happens, get notifications, etc.

> All monitoring added from the CLI will automatically show up as private projects in your account’s dashboard.

Authenticate to snyk.io so you can track your package:

```
snyk auth
```

![](/images/blog/1__NOldN2sYoHYV__SQ9iBjBEg.png)

Now to monitor and track the project dependencies run:

```
snyk monitor
```

Then you can view it in the dashboard as one of your projects at: [https://snyk.io](https://snyk.io)

![](/images/blog/1__fYlIQwmQwJTiTQz39aaGqQ.png)

### CI/CD Integration

Installing snyk for the build:

```
before_install:
  - npm install snyk -g
```

It’s great to also add a badge to your README file so that quality is visible to anyone who explores the project in GitHub or npmjs.com.

Modify the following markdown to match your project’s GitHub’s ***USER*** and repo ***REPONAME:***

[![Known Vulnerabilities](https://snyk.io/test/github/USER/REPONAME/badge.svg)](https://snyk.io/test/github/USER/REPONAME)

Here’s how it looks like in my own project — 
it’s the last badge specifying 0 vulnerabilities.

![](/images/blog/1__rhGdfw1RS1K6zz7IU42JQg.png)

Also, I invite you to read my newly published book [Essential Node.js Security](http://bit.ly/securenodejs)

![](/images/blog/1__1WPY7__gXrww5uoF0ZEF3BA.png)

## More writing

[All writing →](/blog)

*   Sep 5, 2026

    ### [Self-Hosting Hermes Agent with Matrix E2EE on Proxmox](/blog/self-host-hermes-agent-matrix-e2ee-proxmox)

*   Aug 2, 2026

    ### [The Practical Second Brain: Building an LLM-Operated Markdown Knowledge Graph](/blog/practical-second-brain-llm-markdown-knowledge-graph)

*   Aug 1, 2026

    ### [Building a Second Brain with LLMs and AI Agents](/blog/building-second-brain-llms-ai-agents)


* * *

Liran Tal is the author of the book [Node.js Secure Coding: Defending Against Command Injection Vulnerabilities](https://www.nodejs-security.com/)

[Start Building Secure Node.js Applications ↗](https://www.nodejs-security.com/)

 [![](/_astro/nodejs-secure-coding-book-3d-style.DiTWpzFs_Z3c7s1.png)](https://www.nodejs-security.com/)