vm2

There's no reason to believe that [0] has anything to do with WASM, [1] and [2] are runtime implementation bugs, [3] is a vulnerability in a "weak" sandboxing library VM2 - it has nothing to do with WASM as such, and [4] is another implementation bug in an experimental WASI feature of that specific runtime which is gated behind a build flag. ------ [Re: 3] https://github.com/patriksimek/vm2 > vm2 attempts to sandbox untrusted JavaScript code within the same Node.js process as your application. It does this through a complex network of Proxies that intercept and mediate every interaction between the sandbox and the host environment. > JavaScript is an extraordinarily dynamic language. Objects can be accessed through prototype chains, constructors can be reached via error objects, symbols provide protocol hooks, and async execution creates

This could be solved by having some kind of sandbox (https://github.com/patriksimek/vm2), but I agree it complicates it. It would be cool if tsc had a flag —sandboxed or similar that does not allow any sideeffects (fs access, output, forking, net requests, etc)

> the attacker might change the contents of the package instead of adding `postinstall` or `preinstall` hooks. Ultimately, any code inside an npm package needs to be run by default in the context of a sandbox, such as vm2 or SES. That way a developer would have to opt in to granting permissions for a package to run executable code. https://github.com/patriksimek/vm2 https://medium.com/agoric/ses-securing-javascript-in-the-rea...

See blog post on golang playground: https://blog.golang.org/playground NodeJS also includes a sandbox in its standard lib. And there are more advanced versions out there: https://github.com/patriksimek/vm2 Good luck and be careful ;)

Great product announcement post! I especially liked the Q&A section's reasons for not choosing alternatives. Is the lack of maturity also the reason for not choosing something like vm2 for NodeJS https://github.com/patriksimek/vm2