Skip to main content
Python Software Foundation 20th Year Anniversary Fundraiser  Donate today!

A binding to Node.js + vm2, helps you execute JavaScript safely.

Project description Documentation Status dependencies Status

A Python 3 to Node.js + vm2 binding, helps you execute JavaScript safely.


vm2 is a node module to create real sandbox in node. The official node API vm, can only create isolate context and doesn’t prevent harmful code to damage your computer.

How it works

The module launchs a Node.js REPL server, which can be communicated with JSON. All JavaScript code are encoded in JSON and sent to the server. After the server executing the code in vm2, the result is sent back to Python.


You need Node.js.

Install node_vm2 from pypi wheel.

pip install node_vm2

Also make sure you have node executable in PATH, or you can specify the executable with environment variable NODE_EXECUTABLE.

Additionally, you will need npm to build node_vm2 from source.


Most of the APIs are bound to vm2.

Simple eval:

from node_vm2 import eval

print(eval("['foo', 'bar'].join()"))

Use VM:

from node_vm2 import VM

with VM() as vm:"""
      var sum = 0, i;
      for (i = 0; i < 10; i++) sum += i;

Use NodeVM:

from node_vm2 import NodeVM

js = """exports.greet = name => console.log(`Hello ${name}!`);"""

with NodeVM.code(js) as module:
   module.call_member("greet", "John")

It is possible to do async task with Promise:

from datetime import datetime
from node_vm2 import NodeVM

js = """
exports.test = () => {
   return new Promise(resolve => {
      setTimeout(() => {
      }, 3000);
with NodeVM.code(js) as module:

If you like to allow the VM to crash your server (e.g. process.exit()), you should create the VM in a separate server so it won’t affect other VMs:

from node_vm2 import VMServer, VM

with VMServer() as server:
   with VM(server=server) as vm:
      # now the vm is created in a new server
      print("1 + 2 + 3"))


  • 0.3.7 (Mar 23, 2020)
    • Update vm2 to 3.9.0.
  • 0.3.6 (Apr 22, 2019)
    • Update vm2 to 3.8.0. Fix security issues.
  • 0.3.5 (Feb 10, 2019)
    • Update vm2 to 3.6.10. Fix security issues.
  • 0.3.4 (Aug 10, 2018)
    • Update vm2 to 3.6.3. Fix security issues.
  • 0.3.3 (Jul 23, 2018)
    • Fix: don’t bundle dev dependencies.
  • 0.3.2 (Jul 23, 2018)
    • Fix: getting a freezed object would crash the server.
    • Update vm2 to 3.6.2. Fix security issues.
  • 0.3.1 (Apr 25, 2017)
    • Add command arg to VMServer.
    • Fix: A dead default server is created if process spawning failed.
  • 0.3.0 (Apr 23, 2017)
    • Change: use event queue to handle console redirects.
    • Reconize object thrown by VM which doesn’t inherit built-in Error.
  • 0.2.0 (Mar 25, 2017)
    • Drop NodeBridge.
    • Add VMServer.
    • Make all VMs share a default VMServer.
    • Method rename: VM.connect -> VM.create, VM.close -> VM.destroy.
  • 0.1.0 (Mar 23, 2017)
    • First release

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for node-vm2, version 0.3.7
Filename, size File type Python version Upload date Hashes
Filename, size node_vm2-0.3.7-py3-none-any.whl (54.4 kB) File type Wheel Python version py3 Upload date Hashes View
Filename, size node_vm2-0.3.7.tar.gz (24.4 kB) File type Source Python version None Upload date Hashes View

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring DigiCert DigiCert EV certificate Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page