Détail du package

deno-vm

A VM module that provides a secure runtime environment via Deno.

vm, sandbox, jail, worker

readme

deno-vm

GitHub Workflow Status npm

A VM module for Node.js that utilizes the secure environment provided by Deno.

API Documentation

Features

  • Secure out-of-process VM environment provided by Deno.
  • Web Worker-like API
  • Supports Windows, MacOS, and Linux.
  • Tunable permissions (via Deno's permissions).
  • Supports passing ArrayBuffer, TypedArray, Maps, Sets, Dates, RegExp, Errors, MessagePorts, and circular objects.

Installation

Note that Deno needs to be installed and available on the PATH.

npm install deno-vm

Usage

import { DenoWorker } from 'deno-vm';

const script = `
    self.onmessage = (e) => {
        self.postMessage(e.data * 2);
    };
`;

const worker = new DenoWorker(script);

worker.onmessage = (e) => {
    console.log('Number: ' + e.data);
};

worker.postMessage(2);
// Number: 4

Dependencies

deno-vm depends on the following packages:

  • ws - Used for interprocess communication between the Node.js process and Deno. Stopgap solution until Deno gets IPC support.
  • base64-js - Used to serialize/deserialize binary data into JSON.

License

MIT License

Copyright (c) 2020 Casual Simulation, Inc.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

changelog

Changelog

v0.13.0

Date: 4/28/2025

Changes:

  • Added denoConfig, denoNoNPM, and denoExtraFlags options to DenoWorker.
    • denoNoNPM defaults to true to prevent Deno from trying to load or interact with other files/configurations.
    • denoNoNPM needs to be set to true (or denoConfig not be specified) for DenoWorker to be able to load the bootstrap script from node_modules (see #54 for more info).

v0.12.0

Date: 4/12/2024

Changes:

  • Added unsafelyIgnoreCertificateErrors option to DenoWorker to let users skip SSL verification.

v0.11.0

Date: 4/01/2024

Changes:

  • Added location option to DenoWorker to let users customize location.href and scoping for caches

v0.10.4

Date: 2/08/2024

Changes:

  • Updated removeEventListener to also remove exit events.

v0.10.3

Date: 2/02/2024

Changes:

  • Make the minimum Node version 12
  • It's now possible to specify an object for denoUnstable, which can let you enable more fine-grained unstable flags.
new DenoWorker(echoScript, {
    denoUnstable: {
        temporal: true,
        broadcastChannel: true,
    },
});

v0.10.2

Date: 1/29/2024

Changes:

v0.10.1

Date: 12/21/2023

Changes:

  • Update base64 imports to support Deno std 0.210.0.

v0.10.0

Date: 11/20/2023

Changes:

  • Added the ability to close the websocket connection to the Deno subprocess with .closeSocket().

v0.9.1

Date: 10/11/2023

Changes:

  • Fixed an issue where DenoWorker would throw an error when the child Deno process runs out of memory.
    • Thanks to @tmcw for contributing this! (#34)

v0.9.0

Date: 9/15/2023

Changes:

  • Added the spawnOptions configuration option.
    • Useful for customizing how Node spawns the Deno child process.
    • Thanks to @andreterron for contributing this! (#31)

v0.8.4

Date: 1/24/2023

Changes:

  • Added the exit event.
    • This event is triggered on DenoWorker instances when the Deno child process exits.
    • Available via the onexit property or by using worker.addEventListener("exit", listener).

v0.8.3

Date: 12/15/2021

Changes:

  • Added the denoNoCheck option to DenoWorker for the --no-check flag.

v0.8.2

Date: 12/13/2021

Changes:

  • Added the denoV8Flags, denoImportMapPath, denoCachedOnly, and denoLockFilePath options to DenoWorker for the --v8-flags, --import-map, --cached-only, and --lock flags.

v0.8.1

Date: 8/12/2021

Changes:

  • Updated to support Deno 1.12.
    • Deno 1.12 added the MessageChannel and MessagePort APIs which caused MessagePort instances to be untransferrable.
  • Added the denoUnstable option to DenoWorker to enable unstable Deno features.

v0.8.0

Date: 9/17/2020

Changes:

  • Updated to support Deno 1.4.
    • Deno 1.4 changed their WebSocket API and so we no longer need the polyfill.

v0.7.4

Date: 9/10/2020

Changes:

  • Fixed to force the Deno subprocess to close when terminating the worker.
    • Forcing the process to be killed seems to be the most reasonable in the case that we're treating these like headless browser tabs.
    • When we try to gracefully kill the process, Deno might ignore it if it has things like infinite loops or open handles.
    • On Linux/Unix, this means sending a SIGKILL signal to the Deno subprocess.
    • On Windows, this means using taskkill with the /T and /F options.

v0.7.3

Date: 8/28/2020

Changes:

  • Fixed to use the global Object.hasOwnProperty() function instead of relying on objects to have it themselves.

v0.7.1

Date: 7/27/2020

Changes:

  • Fixed to log stdout and stderr in UTF-8.

v0.7.0

Date: 7/27/2020

Changes:

  • Added the ability to get the stdout and stderr streams from the worker and choose whether to automatically log them to the console.
  • Added a global WebSocket polyfill since Deno doesn't implement the WebSocket API.

v0.7.0-alpha.1

Date: 7/27/2020

Changes:

  • Fixed the WebSocket implementation to allow setting binaryType.

v0.7.0-alpha.0

Date: 7/27/2020

Changes:

  • Added a global WebSocket polyfill since Deno doesn't implement the WebSocket API.

v0.6.2

Date: 7/23/2020

Changes:

  • Exported MessageChannel and MessagePort.
  • Added polyfillMessageChannel() to polyfill the MessageChannel and MessagePort objects on the global object.

v0.6.1

Date: 7/22/2020

Changes:

  • Fixed an issue where permissions were being passed incorrectly.

v0.6.0

Date: 7/22/2020

Changes:

  • Added the ability to transfer MessagePort instances between the host and worker.

v0.5.0

Date: 7/21/2020

Changes:

  • Added the DenoWorker class.
    • It is a Web Worker-like API that gives you the ability to run arbitrary scripts inside Deno.
    • Supports the structure-clone algorithm for Maps, Sets, BigInts, ArrayBuffers, Errors, and circular object references.
    • Requires that Deno be installed on the system.