Comment on You too can run malware from NPM (I mean without consequences)parentComments−naugturOP1yIt's based on HardenedJS.orgThe sandbox itself is tight, there's a bug bounty even.The same technology is behind metamask snaps - plugins in a browser extension.And Moddable has their own implementationThe biggest problem is endowing too powerful capabilities.We've got ambitious plans for isolating DOM, but that already failed once before.−1oooqooq1yso to answer the actual question. if something expects too much browser/dom access to work, it won't?
Comments
It's based on HardenedJS.org
The sandbox itself is tight, there's a bug bounty even.
The same technology is behind metamask snaps - plugins in a browser extension.
And Moddable has their own implementation
The biggest problem is endowing too powerful capabilities.
We've got ambitious plans for isolating DOM, but that already failed once before.
so to answer the actual question. if something expects too much browser/dom access to work, it won't?