One glue-layer bug, 344,000 stars of AI plumbing, and the privilege nobody counted

Stars measure attention, not installs, so 344,000 is a proxy and nothing more ^[10]. What makes it worth adding up is that all six projects made the same defensible call: leave vm2, which collected more than twenty documented breakouts before it was deprecated, and move to a real V8 Isolate ^[18][1]. The payoff for that decision was supposed to be that failures stop being architectural. It held. The Isolate boundary did not break; the C++ code marshalling values across it did ^[3].

The escalation path matters more than the count. Endor Labs started from a single ivm.Reference, which is the standard mechanism a host uses to grant a sandbox any capability at all, and finished with control of the host's execution flow ^[2]. The library's own security notes already warned that leaking such an object to untrusted code is usually a trivial springboard back into the Node isolate, yielding complete control of the process ^[11]. The change is that the springboard is now a type confusion in ExternalCopy's transferList handling rather than embedder carelessness ^[1].

So the quantity that matters is not the sandbox, it is the grant wrapped around it. In Mastra's code mode the code inside the isolate is written by a model ^[5]. In Sim.ai's Function blocks, isolated-vm is the component expected to block SSRF and host access ^[8]. Whatever credentials and network reach the enclosing Node process holds become reachable when the glue fails.

The same inheritance appears one layer out, in a product with no connection to this library. OpenAI's Apple Messages plugin needs Full Disk Access, contact access, and automation permissions to read and send messages on a Mac ^[14]. Apple requires those grants precisely because accessibility and automation can circumvent other protections ^[15]. Developer testing of the Full Disk Access list found that whitelisting an app extends its access to child processes it launches ^[16]. Send still requires per-message approval, and OpenAI advises against making that approval persistent ^[17].