Changes to make Electron less prone to Node.js inspector executions

[Gioyik]

Recently I have seen an increase in people using the ability to enable the communication of the inspector mechanism of Node.js (applies to Electron based apps) to execute/spawn host applications. It has taken a few more publicity the topic https://twitter.com/evilsocket/status/1564286074536738816 lately and https://github.com/evilsocket/jscythe.

The current behavior in the tweet is patched electron/electron#33188 in latest versions of Electron, but only if the Electron app uses fuses https://github.com/electron/fuses. There are other apps like 1Password that have other packages to block this behavior, https://github.com/1Password/electron-hardener.

I want to know if this is something that should be kept in mind for the Electron app, if it applies, and what measure can be done.

[Gioyik]

A little more history about this issue mentioned here: https://github.com/antelle/electron-evil-feature-patcher