3 ms·
https://nodejs.org/api/vm.html https://nodejs.org/api/vm.html Bun claims this feature is for running untrusted code (https://bun.com/reference/node/vm https://
by otterley 11mo ago
https://nodejs.org/api/vm.html https://nodejs.org/api/vm.html
Bun claims this feature is for running untrusted code (https://bun.com/reference/node/vm https://bun.com/reference/node/vm), while Node says "The node:vm module is not a security mechanism. Do not use it to run untrusted code." I'm not sure whom to believe.
- Jarred 11mo agoThe reference docs are auto generated from node’s TypeScript types. node:vm is better than using the same global object to run untrusted code, but it’s not really a sandbox
- Brass_Hopper 11mo agoIt's interesting to see the difference in how both treat the module. It feels similar to a realm which makes me lean by default to not trusting it for untrusted code execution. It looks like Bun also supports Shadow Realms which from my understanding was more intended for sandboxing (although I have no idea how resources are shared between a host environment and Shadow Realms, and how that might potentially differ from the node VM module).
- sheepscreek 11mo agoDoesn’t Bun use JavaScriptCore though? Perhaps their emulation, rather implementation, leans more towards security.