Metarhia script loader, node.js vm wrapper

Create script from string

Script contains object expression. You can use it for configs, network packets, serialization format, etc.

const metavm = require('metavm');

const src = `({ field: 'value' });`;
const ms = metavm.createScript('Example', src);
console.log(ms);

Output:

MetaScript {
  name: 'Example',
  script: Script {},
  context: {},
  exports: { field: 'value' }
}

Script contains function expression. You can use it for api endpoints, domain logic stored in files or database, etc.

const metavm = require('metavm');

const src = `(a, b) => a + b;`;
const ms = metavm.createScript('Example', src);
console.log(ms);

Output:

MetaScript {
  name: 'Example',
  script: Script {},
  context: {},
  exports: [Function]
}

Read script from file

const metavm = require('.');

(async () => {
  const ms = await metavm.readScript('./test/examples/simple.js');
  console.log(ms);
})();

Output:

MetaScript {
  name: 'simple',
  script: Script {},
  context: {},
  exports: { field: 'value', add: [Function: add], sub: [Function: sub] }
}

License & Contributors

Copyright (c) 2020-2025 Metarhia contributors. Metavm is MIT licensed.\ Metavm is a part of Metarhia technology stack.

Changelog

Unreleased

1.4.4 - 2025-05-21

• Add node.js 24 to CI
• Update dependencies

1.4.3 - 2024-09-13

• Update eslint/prettier/metarhia configs

1.4.2 - 2024-08-31

• Update eslint to 9.x and prettier with configs
• Add node.js 22 to CI
• Update dependencies
• Update dotfiles, configs, scripts and repo maintenance

1.4.1 - 2023-12-10

• Package maintenance

1.4.0 - 2023-10-25

• Add fetch to default global
• Move to native node.js test runner
• Support node.js 21

1.3.0 - 2023-10-09

• Support new globals for node.js 18 and 20
• Drop node.js 16 and 19

1.2.6 - 2023-07-31

• Classes added to COMMON_CONTEXT: AbortController, Event, EventTarget, MessageChannel, MessageEvent, MessagePort
• Added NODE_CONTEXT with: global, console, process and everything from COMMON_CONTEXT

1.2.5 - 2023-04-29

• Drop node.js 14 support, add node.js 20
• Convert package_lock.json to lockfileVersion 2
• Update dependencies

1.2.4 - 2023-03-10

• Fix 1 line shift in stack traces

1.2.3 - 2023-02-19

• Add node: prefix in require for built-in modules

1.2.2 - 2022-11-16

• Using optional chaining operator
• Package maintenance

1.2.1 - 2022-07-07

• Support local identifiers

1.2.0 - 2022-05-18

• Implement metarequire and require nesting
• Support permissions for node.js modules including internal and npm modules
• Update dependencies and apply security fixes
• Security: prevent eval, update timeout, other context and script options

1.1.0 - 2022-03-15

• Move everything into a single file
• Update dependencies

1.0.3 - 2021-07-19

• Throw SyntaxError on empty files
• Allow optional context
• Move types to package root
• Package maintenance: update dependencies, update engines

1.0.2 - 2021-05-13

• Update dependencies and fix security alert

1.0.1 - 2021-04-13

• Add .d.ts typings

1.0.0 - 2020-12-17

• Add security policy and config for editors
• Remove node.js 13.x support, add 15.x to CI

0.2.0 - 2020-11-30

• Add sandboxed context parameter preventEscape
• Update contributing templates
• Add changelog, and other chore stuff
• Apply prettier and fix code style

0.1.0 - 2020-10-02

First metavm implementation with following features

• Script class with context isolation (sandboxing) for node.js
• Loader script from file with timeout and error handling
• Add use strict if it's not found, fix line offset
• Contexts, use default empty and frozen, emulated or pass one
• Use microtaskMode https://github.com/nodejs/node/pull/34023