Security News
Crates.io Implements Trusted Publishing Support
Crates.io adds Trusted Publishing support, enabling secure GitHub Actions-based crate releases without long-lived API tokens.
By Sarah Gooding - Jul 16, 2025
You're Invited:Meet the Socket Team at BlackHat and DEF CON in Las Vegas, Aug 4-6.RSVP →
vm-browserify
Advanced tools
What is vm-browserify?
The vm-browserify npm package is a browser shim for Node.js's vm module. It allows you to run scripts in a sandboxed environment within the browser, similar to how you would in Node.js. This can be useful for executing code in a controlled and isolated context.
What are vm-browserify's main functionalities?
Running code in a sandbox
This feature allows you to execute a string of code in a new, isolated context. The sandbox object can be used to pass in and out values from the sandboxed environment.
var vm = require('vm-browserify');
var sandbox = { animal: 'cat' };
vm.runInNewContext('console.log(animal)', sandbox);Other packages similar to vm-browserify
sandboxed-module
Sandboxed-module is designed to make it easy to require modules with sandboxed globals, timers, and other Node.js features. It is more focused on sandboxing modules rather than arbitrary code execution.
vm-browserify
emulate node's vm module for the browser
example
Just write some client-side javascript:
var vm = require('vm');
window.addEventListener('load', function () {
var res = vm.runInNewContext('a + 5', { a : 100 });
document.querySelector('#res').textContent = res;
});
compile it with browserify:
browserify entry.js -o bundle.js
then whip up some html:
<html>
<head>
<script src="/bundle.js"></script>
</head>
<body>
result = <span id="res"></span>
</body>
</html>
and when you load the page you should see:
result = 105
methods
vm.runInNewContext(code, context={})
Evaluate some code in a new iframe with a context.
Contexts are like wrapping your code in a with() except slightly less terrible
because the code is sandboxed into a new iframe.
install
This module is depended upon by browserify, so you should just be able to
require('vm') and it will just work. However if you want to use this module
directly you can install it with npm:
npm install vm-browserify
license
MIT
1.1.2 - 2019-11-04
- Update another jQuery reference in the readme. (https://github.com/browserify/vm-browserify/pull/27)
- Get rid of jQuery references altogether from samples and readme. (https://github.com/browserify/vm-browserify/commit/d509e8e5afb7b1ead191cbbd49c37a3fb934b2dc)
FAQs
vm module for the browser
The npm package vm-browserify receives a total of 8,560,970 weekly downloads. As such, vm-browserify popularity was classified as popular.
We found that vm-browserify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 40 open source maintainers collaborating on the project.
Package last updated on 04 Nov 2019
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Related posts
Research
/Security News
Tracking Protestware Spread: 28 npm Packages Affected by Payload Targeting Russian-Language Users
Undocumented protestware found in 28 npm packages disrupts UI for Russian-language users visiting Russian and Belarusian domains.
By Olivia Brown - Jul 15, 2025
Research
/Security News
Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader
North Korean threat actors deploy 67 malicious npm packages using the newly discovered XORIndex malware loader.
By Kirill Boychenko - Jul 14, 2025