Add section 13: Verify documentation examples before copying

[ekreloff]

Summary

Adds a new section to the NPM Security Cheat Sheet covering the documentation attack surface — a class of vulnerability where library README examples teach insecure patterns, even when the library's internal code uses secure defaults.

This pattern has been documented across 5 popular npm packages with combined weekly downloads exceeding 195 million, including findings in encryption libraries (weak key derivation), HTTP clients (credential exposure on redirect), authentication libraries (regex anchoring bypasses), and file upload libraries (insecure randomness).

Why this belongs here

The current cheat sheet thoroughly covers supply chain security (sections 1-12: secrets, lockfiles, run-scripts, auditing, 2FA, typosquatting, etc.) but does not address the risk of copying insecure code patterns from official documentation. This is a distinct attack surface — audit tools won't flag it because the library code itself is safe, only the copy-pasted usage pattern is insecure.

Evidence

• Node.js Security Working Group discussion
• GitHub Security Advisory GHSA-8wrj-g34g-4865
• 5 individual issues filed across expressjs/cors, expressjs/multer, auth0/node-jsonwebtoken, axios/axios, and brix/crypto-js

Format

Follows the existing numbered section format. No library names are used in the section text to keep it evergreen — the patterns are described generically with the security-wg discussion linked for specific cases.

[mackowski]

Thanks @ekreloff!