patriksimek/vm2
Advanced vm/sandbox for Node.js observed · 2026-08-28
Health v2 · maintenance only
99/100
- Activity 99
- Release rhythm 99
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: 8
- age_days: 4614
- days_rel: 9
- days_push: 9
- n_releases_24m: 14
Adoption not part of the score
4093 stars · 328 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded
vm2 is a Node.js library that provides an in-process sandbox for running untrusted JavaScript code with whitelisted access to built-in modules. It uses Proxies to mediate interactions between the sandbox and host environment, though it is known to be vulnerable to sandbox escapes.
Use cases
- run untrusted user-submitted JavaScript safely
- execute plugin code with restricted module access
- sandbox third-party scripts in a Node.js app
- evaluate dynamic expressions from untrusted sources
- create a jail for guest JavaScript code
When to choose
- you need fast, synchronous communication with host objects
- the untrusted code comes from a relatively trusted source
- you accept the risk of sandbox escapes and keep the library updated
When to avoid
- you need strong security guarantees against hostile code
- you cannot tolerate sandbox escape vulnerabilities
- you can use process-level isolation like isolated-vm, containers, or separate workers
Facets
library · maturity maintenance
security interpreter security developer-tools backend sandbox vm untrusted-code isolation nodejs javascript
2 sources
- readme: https://github.com/patriksimek/vm2 · fetched 2026-08-28 · 35e6923feb75
- registry_npm: https://registry.npmjs.org/vm2 · fetched 2026-08-29 · 9182f772853f
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| patriksimek/vm2 | main | 99 |
For agents
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem