The article is patently misleading.<p>Node.js doesn&#x27;t have some magical ability to break out of the browser&#x27;s sandbox.<p>For the trojan to work, the payload still needs to be downloaded and executed on the user&#x27;s machine.<p>The fact that it&#x27;s cross-platform is just a nicety of the platform. The same can be said of most VM based languages.<p>Remove the lowbrow hyperbole and it&#x27;s not a bad writeup. Otherwise, 2&#x2F;10.