  The large amount of third-party packages available in fast-moving software
ecosystems, such as Node.js/npm, enables attackers to compromise applications
by pushing malicious updates to their package dependencies. Studying the npm
repository, we observed that many packages in the npm repository that are used
in Node.js applications perform only simple computations and do not need access
to filesystem or network APIs. This offers the opportunity to enforce
least-privilege design per package, protecting applications and package
dependencies from malicious updates. We propose a lightweight permission system
that protects Node.js applications by enforcing package permissions at runtime.
We discuss the design space of solutions and show that our system makes a large
number of packages much harder to be exploited, almost for free.
