JavaScript (JS) is the programming language of the web: it runs in every browser to make pages interactive and on servers via Node.js.
How JavaScript works
JavaScript was created in 1995 by Brendan Eich at Netscape and is standardised as ECMAScript, with a new edition every year. In the browser, JavaScript changes the page (the DOM), reacts to clicks and loads data from APIs without reloading. Browser engines such as V8 (Chrome, Edge), SpiderMonkey (Firefox) and JavaScriptCore (Safari) compile it to fast machine code. Outside the browser it powers servers (Node.js, Deno, Bun), desktop apps (Electron) and automation. Code is shared through the npm registry, the largest package repository in the world.
Why JavaScript matters for security
- Cross-site scripting (XSS) – injected script runs in the victim’s browser and can steal sessions or data; it remains one of the most common web vulnerabilities.
- Supply-chain attacks – hijacked or typo-squatted npm packages spread malware to thousands of projects; in 2025 attackers compromised widely used packages and even released a self-spreading worm through npm.
- Web skimming – malicious scripts on checkout pages steal card data (Magecart attacks).
- Browser engine bugs – vulnerabilities in V8 and other engines are regularly exploited as zero-days.
- Malicious scripts in e-mail attachments and fake browser updates are used as first-stage malware droppers.
Best practices
- Encode output and use a strict Content Security Policy to limit XSS.
- Lock dependency versions, review new packages and use tools such as npm audit.
- Load third-party scripts with Subresource Integrity (SRI) or host them yourself.
- Keep browsers updated – they patch JavaScript engine bugs every few weeks.
