vm2 is a sandbox for Node.js that executes untrusted code in an isolated environment.
The tool addresses the security risk of running arbitrary code by creating a virtual machine context where scripts execute without access to the host system's resources, globals, or require mechanism. It works by wrapping Node.js's built-in vm module with additional isolation layers, preventing breakout attacks and limiting what sandboxed code can access. Developers can pass data into the sandbox and retrieve results, controlling exactly what the isolated code sees and can do.
Teams should adopt vm2 when they need to safely execute user-supplied scripts, plugin code, or third-party logic without trusting it. This suits applications that accept code uploads, run user-defined transformations, or need to evaluate expressions from untrusted sources. The tool is particularly valuable in multi-tenant systems where one user's code must not interfere with another's or with the host application. It is not a replacement for process-level isolation in high-security scenarios, but rather a lightweight sandboxing layer for moderate threat models where full containerization is impractical.
The project shows consistent maintenance with regular updates addressing reported issues and security concerns. Development activity demonstrates responsiveness to bug reports and pull requests, with fixes applied to address sandbox escape vectors and edge cases. The maintainer engages with the community on security matters and incorporates improvements that strengthen isolation guarantees.
