Supply-chain securityisolated-vm ships a sandbox escape, and the migration story catches up with itself
A type-confusion bug in isolated-vm's ExternalCopy transferList lets sandboxed JavaScript hijack the host process. The library that inherited vm2's job now inherits its threat model too.