Hagana - Runtime protection library for Node.js to protect against npm supply chain attacks
I recently came across an amazing post that really emphasizes the dangers associated with installing npm packages. It seems that every week a new supply chain attack occurs.
In my opinion, the existing solutions for this don't quite cut it so I decided to create a library which provides runtime protection for Node. It currently protects against:
-
Unauthorized file system access
-
Unauthorized network access
-
Unauthorized command execution - (by way of exec/spawn)
I just released the first beta version of the library and I'd love to hear what you guys think.
I like it 😁 Currently I am working on something that supports plugins and this might be something. Maybe build some kind of sandbox with it.
How does it work internally ? Do you override require/import to replace the node inner modules with your own wrappers?
No, I override the actual internal Node APIs with proxies to check at runtime if the command is allowed.
Ah cool, luckily it's open source so I can see the details for myself and learn from it 😁