  Maliciously prepared software packages are an extensively leveraged weapon
for software supply chain attacks. The detection of malicious packages is
undoubtedly of high priority and many academic and commercial approaches have
been developed. In the inevitable case of an attack, one needs resilience
against malicious code. To this end, we present a runtime protection for
Node.js that automatically limits a package's capabilities to an established
minimum. The detection of required capabilities as well as their enforcement at
runtime has been implemented and evaluated against known malicious attacks. Our
approach was able to prevent 9/10 historic attacks with a median install-time
overhead of less than 0.6 seconds and a median runtime overhead of less than
0.2 seconds.
