Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

vm2

Package Overview
Dependencies
Maintainers
3
Versions
65
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

vm2

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!

  • 3.9.19
  • latest
  • Source
  • npm
  • Socket score

Version published
Weekly downloads
1.2M
decreased by-6.52%
Maintainers
3
Weekly downloads
 
Created

What is vm2?

The vm2 npm package is a sandbox that can run untrusted code with whitelisted built-in modules securely. It provides a secure alternative to the default 'vm' module that comes with Node.js and offers more fine-grained control over what the executed code can do.

What are vm2's main functionalities?

Running Untrusted Code Securely

This feature allows you to execute untrusted JavaScript code in a secure sandbox environment, preventing it from accessing the local system or the host process.

const { NodeVM } = require('vm2');
const vm = new NodeVM();
let result = vm.run('return process.platform;');

Isolation of Modules

With vm2, you can control which modules the sandboxed code can require, either by whitelisting specific modules or by allowing/disallowing external modules.

const { NodeVM } = require('vm2');
const vm = new NodeVM({
  require: {
    external: true
  }
});
vm.run('const fs = require("fs");');

Customizable Sandbox

This feature allows you to create a customizable sandbox with specific global properties that the executed code can interact with.

const { VM } = require('vm2');
const sandbox = { x: 20 };
const vm = new VM({ sandbox });
vm.run('x += 3;');
console.log(sandbox.x); // 23

Hooking Console Methods

vm2 allows you to redirect console methods from the sandboxed code to the host environment, enabling you to hook and handle logs, errors, and other console outputs.

const { NodeVM } = require('vm2');
const vm = new NodeVM({
  console: 'redirect'
});
vm.on('console.log', (data) => {
  console.log('Sandboxed log:', data);
});
vm.run('console.log("Hello from the sandbox!");');

Other packages similar to vm2

Keywords

FAQs

Package last updated on 16 May 2023

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc