OWASP/NodeGoat
The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.
License & maintenance
Apache-2.0 is a permissive license: free to use commercially with attribution.
Last code push 2 years ago.