Security by Default: How Automatic npm Scanning Is Changing Web Hosting

The Big Shift Toward Built-In Security

For years, the security of installed packages has been the developer's problem. You spin up a hosting environment, install your dependencies, and it's largely on you to keep everything updated and patched. But a recent partnership between Patchstack and Hostinger is challenging that assumption—and the results are eye-opening.

Within weeks of rolling out automatic npm scanning by default, Hostinger flagged over 10,000 websites containing vulnerable packages. Thousands of site owners have already addressed those issues. That's not a small number. It's a wake-up call.

Why This Matters for Developers and Startups

Here's the uncomfortable truth: most security vulnerabilities don't come from sophisticated attacks or zero-day exploits. They come from outdated packages sitting in your node_modules folder. The Log4Shell vulnerability in 2021 cost organizations millions and affected thousands of applications—many through a single transitive dependency that nobody knew they had.

When hosting providers start taking responsibility for package-level scanning, it changes the entire security equation. Instead of hoping developers notice security advisories or remember to run npm audit, vulnerabilities get flagged automatically—often before the site owner even knows they exist.

What Hostinger's Implementation Actually Does

The partnership integrates Patchstack's vulnerability detection directly into Hostinger's infrastructure. Rather than requiring manual security scans or third-party tools, the platform automatically analyzes npm packages across all hosted sites.

This approach has several advantages:

• Continuous monitoring: New vulnerabilities get flagged as they're discovered, not just during initial setup
• Reduced friction: Developers receive alerts without installing additional tooling
• Prioritized remediation: Site owners get actionable information about which vulnerabilities actually matter

The Developer Experience

Of course, security by default only works if it doesn't disrupt workflows. From what we've seen in this implementation, the focus has been on notification rather than blocking. Site owners receive alerts about vulnerable packages, along with guidance on remediation steps.

This is the right approach. Automated blocking of sites based on package vulnerabilities would create chaos for legitimate businesses. The goal is informed remediation, not preventing deployment.

Could This Become the New Standard?

Hostinger isn't the only hosting provider thinking about this, but they're ahead of the curve. As security breaches continue to cost companies reputation and revenue, expect more providers to adopt similar approaches.

For developers and startups choosing a hosting provider, security features like automatic npm scanning should now factor into your decision. A platform that watches your dependencies is worth considering over one that leaves you completely on your own.

The Bottom Line

Ten thousand flagged sites in just weeks proves that vulnerable packages are everywhere—even on sites their owners thought were secure. The question isn't whether your dependencies have issues; it's whether you'll find out about them before someone else does.

Automatic npm scanning represents a shift in how we think about hosting security. It's no longer enough for providers to offer fast servers and good uptime. The next generation of hosting needs to actively protect what's running on those servers.

For now, whether you're on Hostinger or elsewhere, it might be time to run npm audit on your projects. You might be surprised what you find.

Have you been notified about vulnerable packages on your sites? What's your take on hosting providers taking a more active role in security? Share your thoughts below.