v8-vulnerabilities VS npq

Why should I trust Node.js team Nodejs : Security Vulnerabilities or V8 v8-vulnerabilities?

The problem with Node.js and Deno is relying on and carrying around the non-trivial V8 https://github.com/Zon8Research/v8-vulnerabilities that uses ~40MB. That is one reason QuickJS that uses ~5MB is being compiled to WASI/WebAssembly as the embeddable JavaScript runtime.

Node.js and Deno do. Explaining V8 is non-trivial, e.g., v8-vulnerabilities.

You might also want to look at npq which is an open source project that helps you proactively defend against potentially bad (malicious) npm packages before installing them.

You just described my project called npq: https://github.com/lirantal/npq :-)

That's pretty cool. I was just recently publishing about Ruby gem lockfile injection attacks (read here: https://snyk.io/blog/ruby-gem-installation-lockfile-injection-attacks/). I also wrote something related to this for npm users, but not a sandbox, called npq: https://github.com/lirantal/npq/

In any case, proactively protecting against is indeed the more difficult thing to do, but also the rarer and sort of 0 day vulnerabilities that happen. That said, I built a module called npq (see here https://github.com/lirantal/npq/) that helps me, and others, countermeasure against these sort of malicious incidents. In light of recent malicious incidents, it calls for updating some of the capabilities there (referred to as marshalls)