RED-174764: electron run as node

[pd-redis]

What

Disables the ELECTRON_RUN_AS_NODE fuse to prevent sandbox bypass attacks reported in RED-174764

When ELECTRON_RUN_AS_NODE=1 environment variable is set, an attacker with local access could run arbitrary JavaScript using the signed RedisInsight binary, bypassing Electron's sandbox and security controls.

This fix adds an afterPack hook to electron-builder that flips the RunAsNode fuse to false during the build process, following Electron's security recommendations.

Before	After
ELECTRON_RUN_AS_NODE=1 "Redis Insight" -e 'console.log("executed")' runs arbitrary JS	Environment variable is ignored, app exits normally

Testing

1. Build the app using CI or locally with yarn package:prod
2. Download/locate the built binary
3. Verify fuses are correctly set: npx @electron/fuses read --app "./Redis Insight.app"

npx @electron/fuses read --app /Applications/Redis\ Insight.app
Analyzing app: Redis Insight 2.app
Fuse Version: v1
  RunAsNode is Disabled
  EnableCookieEncryption is Disabled
  EnableNodeOptionsEnvironmentVariable is Enabled
  EnableNodeCliInspectArguments is Enabled
  EnableEmbeddedAsarIntegrityValidation is Disabled
  OnlyLoadAppFromAsar is Disabled
  LoadBrowserProcessSpecificV8Snapshot is Disabled
  GrantFileProtocolExtraPrivileges is Enabled

4. Test the original exploit no longer works:
   • app should show normal UI
     # macOS ELECTRON_RUN_AS_NODE=1 "./Redis Insight.app/Contents/MacOS/Redis Insight" -e 'console.log("VULNERABLE")' # Should NOT print "VULNERABLE"
5. Verify the app still launches and functions normally

---

Note

Hardens the packaged app by flipping Electron fuses during build to block node execution via environment variable.

• Adds scripts/afterPack.js that uses @electron/fuses to set FuseV1Options.RunAsNode=false on the packaged binary across macOS/Windows/Linux
• Wires the hook in electron-builder.json via afterPack

^{Written by Cursor Bugbot for commit 9fce0a9. This will update automatically on new commits. Configure here.}

[github-actions]

Code Coverage - Frontend unit tests

St.❔	Category	Percentage	Covered / Total
🟢	Statements	82.83%	21092/25463
🟡	Branches	68.04%	8880/13051
🟡	Functions	78.01%	5780/7409
🟢	Lines	83.24%	20660/24820

Test suite run success

5487 tests passing in 704 suites.

Report generated by 🧪jest coverage report action from 9fce0a9