Deno is pretty interesting because it has built in sandboxing. By default, no code can even access the network. Everything must be explicitly allowed, including network access and environment variables: https://docs.deno.com/runtime/fundamentals/security/
Access can be scoped pretty granularly as well, only allowing access to specific websites or env variables.
I really like this model since it offers a strong protection against secrets stealers, which have hit NPM extremely frequently. No more of malicious NPM packages scraping the whole system to find secrets.
It does have a performance tradeoff compared to Bun. Bun is (was?) the fastest, Node was the slowest, Deno was in the middle.
Is there another nodejs alternative that supports typescript in a similar way?
Does Deno fit your needs? It is also a drop-in replacement to a large degree, but is somewhat focused on improving the related tooling environment.
I’m not very involved in the (non-browser) JS ecosystem, but it’s my tool of choice.
I second Deno. Did a few small projects with it and I have no complaints.
Deno is pretty interesting because it has built in sandboxing. By default, no code can even access the network. Everything must be explicitly allowed, including network access and environment variables: https://docs.deno.com/runtime/fundamentals/security/
Access can be scoped pretty granularly as well, only allowing access to specific websites or env variables.
I really like this model since it offers a strong protection against secrets stealers, which have hit NPM extremely frequently. No more of malicious NPM packages scraping the whole system to find secrets.
It does have a performance tradeoff compared to Bun. Bun is (was?) the fastest, Node was the slowest, Deno was in the middle.
This looks nice actually. I can’t remember but I think there was some disadvantage compared to bun.
Performance, it’s slightly slower compared to Bun, but it is faster than Node. But it has sandboxing, which is neat.
Not to the degree where bun support it. But NodeJS itself has now supported running typescript for a while