Security review of Node.js / JavaScript code — dangerous sinks and Express/framework pitfalls. Load when reviewing a Node/JS codebase/PR, on package.json + Express/Next/Nest, or "review this Node app". Signals: child_process, eval, Function, prototype pollution, JWT, Mongoose/Sequelize.
