Vulnerable Nodejs — a real shop (NodeBazaar) intentionally full of security bugs. 14 labs, OWASP Top 10:2025, SAST benchmark. Node.js port of DVWA.
cr0hn/vulnerable-node has 488 GitHub stars.
It currently ranks #12993 daily, #13998 weekly, #17345 monthly by momentum on Trending Repos; its best-ever rank is #6999.