# Install vm2 with npm

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Version 3.11.5 via npm; verified 2026-05-18.

## Install

```sh
sudo av install npm:vm2
```

Additional install commands:

### Portable and language managers

- npm (100%):

```sh
npm install -g vm2
```

  Evidence: local npm package metadata

## Package facts

- **Package key:** npm:vm2
- **Package manager:** npm
- **Package manager page:** <https://www.npmjs.com/package/vm2>
- **Version:** 3.11.5
- **Source summary:** vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.
- **Homepage:** <https://github.com/patriksimek/vm2#readme>
- **Repository:** <https://github.com/patriksimek/vm2>
- **Upstream docs:** <https://github.com/patriksimek/vm2#readme>
- **License:** MIT
- **Source archive:** <https://registry.npmjs.org/vm2/-/vm2-3.11.5.tgz>
- **Issue tracker:** <https://github.com/patriksimek/vm2/issues>
- **Published:** 2026-05-18T15:37:26.138Z
- **Last updated:** 2026-05-18T15:37:26.138Z
- **Generated:** 2026-07-10T07:20:53+00:00

## Executables

- vm2 (cli)
- vm2 (alias)

## Dependencies

- acorn
- acorn-walk

## Build dependencies

- eslint
- mocha

## Install behavior

- Post-install hook: not defined
- Bottle: not available

## Freshness

- Page generated: 2026-07-10
- Package-manager version: 3.11.5
- Package-manager updated: 2026-05-18
- Local data: ok
- Upstream repository: https://github.com/patriksimek/vm2
- info: No cached GitHub release or tag data was available.

## Security Notes

No matching local secret-handling manifest was found for vm2. Nucleus package metadata is still published here so future coverage has a stable package URL.


## Source Database Details

- **Source Database:** npm registry
- **Dist Tags:** Latest: 3.11.5
- **Version Count:** 77
- **Maintainers:** patriksimek
- **Author:** Patrik Simek
- **Publisher:** GitHub Actions
- **Engines:** Node: >=6.0
- **Integrity:** sha512-RSrkBiwrj6FRU+QdqNs6KG0XdlvJCjpQ4GXiqmMbrhmwfu5k/XIMpAer0L8f6iuf0uJ3a4T1xJN126Q8yf0VIA==
- **Shasum:** 6dcebf22c7bf77acf80571f26f1040ee626a97d0
- **Unpacked Size:** 385,628
- **File Count:** 0
- **Created At:** 2014-01-14T12:17:34.402Z
- **Latest Published At:** 2026-05-18T15:37:26.138Z
- **Modified At:** 2026-05-18T15:37:26.420Z


## Related links

- [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched curated package taxonomy and local package facts.
- [lavamoat](https://www.automicvault.com/pkg/npm/lavamoat/) - Both packages touch the same language runtime or ecosystem. Shared terms: cli, code, is, modules, node.
- [sandvault](https://www.automicvault.com/pkg/brew/sandvault/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, run, sandbox, sandboxing, security.
- [bubblewrap](https://www.automicvault.com/pkg/brew/bubblewrap/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, sandbox, sandboxing, security.

## Sources

- Nucleus package database
- package-page enrichment
- package version freshness
- av.db category and tag curation
- package relationship graph
- cross-ecosystem install command graph