Sandworm Guard

Easy auditing & sandboxing for your JavaScript dependencies 🪱
​​
​ ​
​ ​
​ ​
​ ​
​​
Summary
Sandworm Guard intercepts all potentially harmful Node & browser APIs, like arbitrary code execution (child_process.exec) or network calls (fetch). It knows what packages are responsible for each call.
Simple obfuscation techniques can confuse static analysis tools, but Sandworm's dynamic analysis will always intercept risky calls at run time.
You can use Sandworm Guard to:
audit your dependencies, monitor activity and permissions, and see what your code is doing under the hood using the Inspector;
generate a security profile automatically from your test suite and do snapshot testing against it;
secure your app against supply chain attacks by enforcing per-module permissions.
Install it as an npm module in your existing Node or browser app.
Works in Node v15+ and modern browsers. Beta support for browsers and sourcemaps.
Get involved
Have a support question? Post it here.
Have a feature request? Post it here.
Did you find a security issue? See SECURITY.md.
Did you find a bug? Post an issue.
Want to write some code? See CONTRIBUTING.md.
The permission database project
A longer-term goal for Sandworm is to provide an open, public database of per-package permission requirements, based on:
running automated tests with Sandworm enabled for public packages;
anonymous info about requirements collected from real-world apps by the inspector.
For every method call that Sandworm intercepts, the inspector will share the following info:
{
  "module": "CALLER_MODULE_NAME",
  "family": "INVOKED_METHOD_FAMILY",
  "method": "INVOKED_METHOD_NAME",
  "sessionId": "INSPECTOR_SESSION_ID"
}
This will make it easier for everyone to audit packages and set up Sandworm. To opt out of sharing data with the community, run the inspector with the --no-telemetry option. You can also audit what's getting sent and the server code.
How Sandworm is tested
Sandworm has several layers of automated testing:
Jest is used to run Node.js capture & enforce tests for all supported Node APIs (tests run on Node 16.10 and above). See the tests/node directory.
Playwright is used to run browser capture & enforce tests for all supported browser APIs (tests run on WebKit, Chromium, and Firefox). See the tests/web directory.
Jest is used to run unit tests on the core Sandworm source files. See the tests/unit directory.
Check out our latest test run inside our CircleCI pipeline.
Chart Info
Overview
Last modified 6mo ago