🔑 The easiest way to control what npm modules can access
NOTE: This package has not gone through any form of security testing! Please do not use it to ensure security at this time. Issues questioning the feasability of our current approach are still outstanding.
If you're experienced in this area ( I am not ) please contribute!
This repo / package was inspired a Medium post by David Gilbertson - https://hackernoon.com/npm-package-permissions-an-idea-441a02902d9b
Imagine a package, created and maintained by npm (or someone equally trustworthy and farsighted). Let’s call it @npm/permissions.
You would include this @npm/permissions package as the first import in your app, either in a file, or you run your app like node -r @npm/permissions index.js.
This would override require() to enforce the permissions stated in a package’s package.json permissions property.
With the exception of some small differences, like not using package.json to manage permissions, this package attempts to accomplish this goal.
How it works
NodeSecurity works by overriding the Node.JS
require() function, allowing us to enforce access constraints.
npm install @matthaywardwebdesign/node-security
Firstly include NodeSecurity in your project at the very top of your applications entrypoint (before any other requires) and create a new instance.
const nodesecurity = ;const NodeSecurity = ;
Note: If you're using the ES6 imports you'll need to create a seperate file that is imported at the entrypoint of your application. Without doing this it won't be possible to configure NodeSecurity before any other modules are loaded.
🎉 And you're done! 🎉
All required / imported modules from this point onwards will have to be allowed by our configuration.
Here's an example script!
/* Import and create a new instance of NodeSecurity */const nodesecurity = ;const NodeSecurity = ;/* Configure NodeSecurity */NodeSecurity;/* This won't throw an error as fs-extra is allowed to access fs */;/* Accessing fs directly will throw an error */;/* Accessing os.arch will throw an error */const os = ;os;
You can extend the functionality of NodeSecurity by creating a plugin. For example you could create a plugin to allow http/s requests to only be made to specific servers.
An example plugin can be found at
Plugins work by providing a way to override the default functionality of a core module. By default every Node core module (fs, os, etc) has a plugin loaded that allows for module methods to be disabled.
Including your own plugin is as simple as adding a plugins section to your configuration.
Building the package
npm run build
Running the test suite
- Include a set of default plugins that allow for more granular filesystem and network access.