I have a Node.js app which has a lot of npm-dependencies, running on Linux (Centos) machine.

When Node starts, the script has access to the files outside its directory (as least by default), so malicious npm-package could traverse a directory tree and read config files, etc.

I would like to restrict FS access to the script directory only. Is this possible?

  • It's going to have the same permissions as the user that launches it... so create a user for the app to run as with the permissions you want.
    – pcalkins
    Oct 26, 2022 at 21:28


You must log in to answer this question.

Browse other questions tagged .