supply chain / helmet

Helmet

registrynpm
package namehelmet
maintainerHelmet Contributors

Helmet is an Express middleware that sets security-related HTTP response headers (Content-Security-Policy, HSTS, X-Frame-Options, and others). It is used to harden Express applications against common web vulnerabilities. It runs as middleware on every response.

api usage

Checking Helmet

helmet 8.0.0 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.

bash
curl "https://api.attestd.io/v1/check?product=helmet&version=8.0.0" \
  -H "Authorization: Bearer YOUR_API_KEY"
example response
json
{
  "product": "helmet",
  "version": "8.0.0",
  "supported": true,
  "risk_state": "none",
  "risk_factors": [],
  "actively_exploited": false,
  "remote_exploitable": false,
  "authentication_required": false,
  "patch_available": false,
  "fixed_version": null,
  "confidence": 0.9,
  "cve_ids": [],
  "cves": null,
  "max_epss": null,
  "typosquat": null,
  "supply_chain_monitored": true,
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null
  },
  "last_updated": "2026-05-01T00:00:00Z"
}
attack surface

Why this package is monitored

Helmet is trusted to set CSP, HSTS, and related response headers on every Express response. Weakening those headers can allow hostile scripts or TLS downgrade without changing application routes.

Attestd monitors helmet using the following detection sources:

registry

Manually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.

osv

OSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.

npm_deprecation

npm package versions with deprecation messages containing targeted attack language such as malicious, backdoor, or compromised. Confidence 0.80.

related