
Research
/Security News
Fake imToken Chrome Extension Steals Seed Phrases via Phishing Redirects
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.
execjs
Advanced tools
ExecJS lets you run JavaScript code from Ruby. It automatically picks the best runtime available to evaluate your JavaScript program, then returns the result to you as a Ruby object.
ExecJS supports these runtimes:
A short example:
require "execjs"
ExecJS.eval "'red yellow blue'.split(' ')"
# => ["red", "yellow", "blue"]
A longer example, demonstrating how to invoke the CoffeeScript compiler:
require "execjs"
require "net/http"
source = Net::HTTP.get(URI("https://coffeescript.org/browser-compiler-legacy/coffeescript.js"))
context = ExecJS.compile(source)
context.call("CoffeeScript.compile", "square = (x) -> x * x", bare: true)
# => "var square;\nsquare = function(x) {\n return x * x;\n};"
If you'd like to use a specific runtime rather than the autodetected one, you can assign ExecJS.runtime:
ExecJS.runtime = ExecJS::Runtimes::Node
Alternatively, you can define it via the EXECJS_RUNTIME environment variable:
EXECJS_RUNTIME=Node ruby ...
You can find the list of possible runtimes in lib/execjs/runtimes.rb.
$ gem install execjs
Why can't I use CommonJS require() inside ExecJS?
ExecJS provides the lowest common denominator interface to any JavaScript runtime. Use ExecJS when it doesn't matter which JavaScript interpreter your code runs in. If you want to access the Node API, you should check another library like commonjs.rb designed to provide a consistent interface.
Why can't I use setTimeout?
For similar reasons as modules, not all runtimes guarantee a full JavaScript
event loop. So setTimeout, setInterval and other timers are not defined.
Why can't I use ES5 features?
Some runtimes like Node will implement many of the latest ES5 features. However older stock runtimes like JSC on OSX and JScript on Windows may not. You should only count on ES3 features being available. Prefer feature checking these APIs rather than hard coding support for specific runtimes.
Can ExecJS be used to sandbox scripts?
No, ExecJS shouldn't be used for any security related sandboxing. Since runtimes
are automatically detected, each runtime has different sandboxing properties.
You shouldn't use ExecJS.eval on any inputs you wouldn't feel comfortable Ruby
eval()ing.
ExecJS is the work of dozens of contributors. You're encouraged to submit pull requests, propose features and discuss issues.
See CONTRIBUTING.
ExecJS is released under the MIT License.
FAQs
Unknown package
We found that execjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.

Security News
Latio’s 2026 report recognizes Socket as a Supply Chain Innovator and highlights our work in 0-day malware detection, SCA, and auto-patching.

Company News
Join Socket for live demos, rooftop happy hours, and one-on-one meetings during BSidesSF and RSA 2026 in San Francisco.