I hear this a lot and hence have the same feeling about node/electron but is there actually anything of substance when it comes to the lack security of Node/Electron apps? Honestly curious.
Electron I guess implies backdoors via binary blobs upstream?
https://www.blackhat.com/docs/us-17/thursday/us-17-Carettoni...
Electron has local file access, etc. in fact, it states: “Under no circumstances should you load and execute remote code with Node.js integration enabled.”
So, Stealth should consider forking Electron if better sandboxing is needed.
https://www.electronjs.org/docs/tutorial/security
That doesn’t prevent it from being secure, though.
If I download and build chromium (as long as I don’t disable the sandbox altogether) I don’t actually need to think about those issues while I do need to do that with Electron.