Every Node.js project accumulates vulnerable dependencies. The npm registry holds over 2.5 million packages, and researchers found 454,000 malicious or vulnerable packages uploaded in 2025 alone.

Companies are ranked according to revenue for design services performed in 2022 in $ millions (*). Those with subsidiaries are indicated by (†). For information on subsidiaries and where each firm ...