Loading the post…
This week at CloudFest Americas, CloudLinux is introducing RunShield, a new product that protects Node.js apps from inside the running process. RunShield checks every package an app loads. It patches the known vulnerabilities it has a fix for and stops compromised packages before their code runs. A second layer watches for common attacks on the app, so an attack on a vulnerability that has no patch yet can still be caught.
The app’s code and files stay as they are, so the host can protect an app without waiting for its owner.
RunShield is in early access. Its free version reports what it finds, and the paid protection mode acts on it. Hosting providers can join early access now to get a free, 2-month trial of the protection mode.
Vibe coders describe the app they want to an AI tool and ship what AI writes. By June 2026, Lovable, one AI app builder, said its users were starting 1 million new projects a week, and its own survey puts four in five of them in non-technical roles.
What the AI writes is often a Node.js app, and the AI picks its npm packages as well as writing its code. Neither is reliably safe. In Veracode’s tests of more than 100 AI models, the generated code introduced a known type of security flaw in 45% of tasks.
Many of those apps end up on hosting servers. Node.js apps on CloudLinux servers grew 51% in a year, to more than 200,000 on 16,000+ servers (CloudLinux data, March 2026). Their packages age there. In our data from October 2026, 84% of servers running Node.js apps had at least one npm package with a known vulnerability, and 73% had one rated critical.
Some packages are dangerous the day they’re installed. In September 2025, attackers phished a well-known npm maintainer and published malicious releases of chalk and debug, two of the most downloaded packages on npm. Every app that installed them before npm pulled them took in code written to steal cryptocurrency.
The host sees all of this from the server and can change none of it. The code belongs to the app’s owner, who rarely updates it, and security tools built for developers wait for a developer to install them.
RunShield runs inside each Node.js app, between the app’s code and the Node.js runtime. It checks the packages the app loads, patches the vulnerable ones it has a fix for without changing the files on disk, and analyzes incoming requests and the code they run to catch attacks.
Report mode is the free version. RunShield shows the vulnerable and compromised packages each app loads and the attacks it detects, and changes nothing.
Protection mode is the paid version. On top of reporting, RunShield virtual patches vulnerable packages, stops compromised ones before they run and blocks common attacks.
The server’s administrator sets the mode and decides whether app owners may change it. App owners are not required to change anything. Where the administrator allows it, they can switch modes for their own apps. Otherwise they can follow their apps' events in a dashboard.
Virtual patching. When an app loads a package release that RunShield has a patch for, RunShield hands Node.js a fixed copy of that code. The file on disk stays as it is.
Compromised packages blocked. RunShield checks every package an app loads, dependencies of dependencies included, against trusted security feeds of compromised npm releases. It recognizes more than 7,000 compromised releases of more than 3,000 npm packages. In protection mode it stops a compromised package before its code runs. In report mode it flags it. Clean releases of the same package keep working.
Common attacks detected and stopped. Where a vulnerability has no patch yet, a second layer watches the app for the common attacks on Node.js apps as they happen, including attacks on flaws in the app’s own code. It detects them in report mode, and in protection mode it blocks SQL and NoSQL injection.
RunShield also records which package versions each app actually loads, and shows which are vulnerable, which run patched and which it flagged or stopped.
RunShield runs on x86-64 Linux servers with systemd. It protects apps on Node.js 16, 18, 20 and 24, whether they’re started by systemd, PM2, a container or a control panel. On servers running Imunify360 or ImunifyAV, the free version comes included.
To try protection mode free for two months, join early access. We’ll be in touch to plan the setup with you.
To see what RunShield would find in one of your apps today, paste its package-lock.json into the free dependency check. It runs in your browser, and nothing leaves it.
At CloudFest Americas in Miami this week? Find us at the CloudLinux booth.
Akos Vajda
Comments