Node.js Is Popular With DevOps Teams, But Security Practice Lags Behind Adoption

This article is based on reporting originally published by enterprisetech.com, drawing on survey data released by NodeSource and Sqreen.

Node.js Adoption Outpacing Security Readiness

Node.js has earned a strong foothold in DevOps toolchains, with NodeSource — a commercial Node.js runtime vendor — describing it as “the runtime of choice for DevOps.” Yet a joint survey conducted by NodeSource and application security startup Sqreen reveals a troubling gap: developer teams are adopting Node.js rapidly while underinvesting in the security practices needed to protect the applications they build with it.

Key Survey Findings

The survey polled Node.js developers and technology executives. Its headline findings paint a picture of widespread security anxiety paired with limited remediation activity:

• More than one-third of respondents expect their organization to be hacked, with many resigned to a significant attack within the next six months.
• 60 percent of developers expressed concern about the security of their applications.
• Only 16 percent were confident that third-party modules used in their projects are free of vulnerabilities.
• Only 30 percent combine manual and automated code reviews to identify known vulnerabilities.
• Only 30 percent reported scanning third-party code to detect vulnerable dependencies.
• Just 35 percent of companies combine code reviews with automated tooling to search for vulnerabilities.
• Only 23 percent of respondents use any form of real-time threat detection.
• The most common monitoring approach — used by 44 percent — is log inspection, a largely reactive method.
• 35 percent of developers acknowledged they have no reliable way of knowing when their applications are actively under attack.

Security Is a Concern, Not a Priority

“Our survey results clearly demonstrate that security is a concern for developers — but not a priority,” said Joe McCann, CEO of NodeSource, in a statement accompanying the survey release.

The findings reflect a tension familiar across modern software delivery: the pressure to ship code quickly competes directly with the time and discipline required to secure it. Release cycles that once ran monthly now run weekly, and individual code components may be updated multiple times per day. In that environment, security reviews are often deferred or skipped entirely.

Open Source Dependencies Amplify the Risk

Node.js development relies heavily on the npm ecosystem, which provides access to hundreds of thousands of open source packages. The convenience of reusing community-maintained modules accelerates development but introduces a significant supply-chain risk: vulnerabilities in upstream packages can propagate into production applications without any action by the application developer.

Security experts cited in the original reporting note that the greater availability and use of open source code — which is often maintained inconsistently — has heightened these concerns. The survey data supports this: only 16 percent of respondents expressed confidence in the security posture of their third-party dependencies.

Tools Exist, But Adoption Remains Low

“Developers have a wide array of security tools at their disposal that they are simply not using,” said Jean-Baptiste Aviat, co-founder and CTO of Sqreen. Aviat and his co-founder previously worked as security specialists at Apple before founding Sqreen, which provides runtime application self-protection (RASP) and security monitoring software.

The categories of tooling available to Node.js development teams include:

• Static analysis (SAST): Scans source code for known vulnerability patterns before deployment.
• Software composition analysis (SCA): Audits third-party and open source dependencies for known CVEs. Tools such as npm audit, Snyk, and OWASP Dependency-Check fall into this category.
• Dynamic analysis (DAST): Tests running applications for exploitable weaknesses.
• Runtime protection (RASP): Monitors application behavior in real time and can block attacks as they occur — the category Sqreen operates in.
• Security Information and Event Management (SIEM): Aggregates and correlates security events across systems for centralized visibility.

The survey found that SIEM adoption among Node.js teams was low, with log inspection being the dominant — and largely reactive — monitoring approach.

Real-Time Detection: The Most Critical Gap

Perhaps the most operationally significant finding is that only 23 percent of Node.js developers use any form of real-time threat detection. Relying on log analysis means that by the time a team identifies an attack, damage may already be done — data exfiltrated, services disrupted, or credentials compromised.

The 35 percent of developers who reported having no way to detect active attacks represent a particularly high-risk cohort. Without visibility into runtime behavior, these teams cannot distinguish normal traffic from exploitation attempts, nor can they respond to incidents in a timely manner.

What DevOps Teams Should Do

The survey data points to several practical areas where DevOps and development teams can close the security gap without overhauling their entire workflow:

1. Integrate dependency scanning into CI/CD pipelines. Running npm audit or a dedicated SCA tool on every build catches vulnerable packages before they reach production.
2. Automate code review checks. Pairing human code review with static analysis tools reduces the burden on reviewers and catches vulnerability classes that humans commonly miss.
3. Add runtime visibility. Even basic application performance monitoring (APM) with security alerting provides far more insight than log inspection alone.
4. Treat security as a pipeline gate, not a post-deployment audit. Shifting security left — embedding checks early in development — reduces the cost and disruption of remediating vulnerabilities found in production.
5. Inventory and continuously monitor third-party modules. As the npm dependency tree grows, automated tooling is the only scalable way to track which packages are in use and whether they have been flagged for vulnerabilities.

Conclusion

Node.js has become a foundational runtime for many DevOps teams, valued for its performance, extensive package ecosystem, and JavaScript’s ubiquity. But popularity without security discipline creates a large and growing attack surface. The NodeSource/Sqreen survey suggests that awareness of the problem is high while action to address it remains limited. Closing that gap requires treating security tooling as an integral part of the delivery pipeline rather than an optional add-on applied after the fact.

Original reporting: enterprisetech.com. Survey conducted by NodeSource and Sqreen (published 2017).