# npm security research — Liran Tal

The npm security guidance I co-authored became the original basis of OWASP’s npm security cheat sheet.

Canonical: https://lirantal.com/research/npm-security

## The original npm security best practices

Juan Picado and I published “10 npm Security Best Practices” on the Snyk blog in February 2019. We brought package publishing, installation behavior, dependency health, and account protection into a practical guide for JavaScript developers.

The work connects common development decisions to security consequences: what enters a published tarball, when install scripts execute, and how dependency changes reach a build.

*   [Read the co-authored original ↗](https://snyk.io/blog/ten-npm-security-best-practices/)

## Adoption by OWASP

The introduction to OWASP’s NPM Security Cheat Sheet states that its list was originally based on that Snyk article. This provides a direct trail from the original guidance to a community-maintained security reference.

The OWASP document has continued to evolve with contributions from its community. The original guidance is one contribution to that evolving community resource.

*   [Read the OWASP cheat sheet & original attribution ↗](https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_Cheat_Sheet.html)

## Continuing the work

I maintain npm-security-best-practices as a practical resource for package-manager security. It covers installation policies, dependency sources, release cooldowns, publishing trust, and safer local development.

This sits alongside my lockfile injection research and tools such as lockfile-lint and npq: research findings translated into checks developers can use in their own workflows.

*   [Explore npm-security-best-practices ↗](https://github.com/lirantal/npm-security-best-practices)

## At a glance

Original article

February 19, 2019

Co-authors

Liran Tal & Juan Picado

Adopted by

OWASP Cheat Sheet Series

[Sources & attribution ↓](#sources)

## Sources & attribution

*   [10 npm Security Best Practices · Liran Tal & Juan Picado, 2019 ↗](https://snyk.io/blog/ten-npm-security-best-practices/)
*   [NPM Security Cheat Sheet · OWASP ↗](https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_Cheat_Sheet.html)
*   [Maintained guidance · npm-security-best-practices ↗](https://github.com/lirantal/npm-security-best-practices)