Question 1

What are the main security risks of using the 'eval()' function in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security-focused phone screens — no prior security background assumed. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Every consequence below was **actually demonstrated by running real code**, not described as a hypothetical. ## 1. Why This Even Matters — A Story First Handing a stranger a blank check with your signature already on it is fun

Question 2

Explain the concept of REPL in Node.js

Accepted Answer

**Target Audience:** Engineers preparing for Node.js phone screens — no prior REPL experience assumed. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The session transcript below came from an **actually running, programmatic REPL session** on Node v24.19.0, not a description of expected behavior. ## 1. Why This Even Matters — A Story First A chemist testing a small reaction does not build an en

Question 3

What is the purpose of `__dirname` and `__filename` in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js phone screens — assumes very basic file-path familiarity. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The values below were printed from a **real file on disk**, deliberately not from `node -e`, which was checked first and produces misleading placeholder values instead. ## 1. Why This Even Matters — A Story First A person gives directions

Question 4

What is the difference between spawn() and exec() in Node.js?

Accepted Answer

The main difference is that `spawn` runs a process and streams its output in real-time, making it ideal for large volumes of data or long-running processes. Conversely, `exec` runs a command in a shell and buffers the entire stdout/stderr output before returning it in a callback, which can fail if the buffer size exceeds its limit (default 1024KB). Use `spawn` for streaming data and `exec` for running simple commands with small execution outputs.

Question 5

What is top-level await and what are its caveats in Node.js ESM?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js ESM and async-architecture interviews — assumes familiarity with the module-type question's real require(ESM) boundary. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both timing claims below were **actually measured** with real `Date.now()` deltas around real `setTimeout`-based delays — genuine milliseconds, not illustrative numbers. ## 1.

Question 6

What are some common security best practices in Node.js applications?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security-focused system-design interviews — assumes familiarity with the individual topics this answer cross-links to. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The `npm audit` and `helmet` results below came from **actually running both** against a real, deliberately-vulnerable setup on Node v24.19.0. ## 1. Why This Even Matters — A St

Question 7

How does CommonJS `require()` an ES Module in modern Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for senior Node.js interviews — assumes CommonJS vs ESM basics. **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both outcomes below — the success and the failure — were **executed against Node v24.19.0**, and the exact error text is pasted from that run. ## 1. Why This Even Matters — A Story First Two departments in a company speak different languages and

Question 8

What is the 'vm' (Virtual Machine) module and when would you use it?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js interviews — assumes basic `eval()`/scope familiarity (see the dedicated `eval()` risks question). **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The sandbox isolation below was **actually verified** on Node v24.19.0, in both directions — not assumed from the module's name. ## 1. Why This Even Matters — A Story First A test kitchen physically

Question 9

What is the package.json "exports" field and conditional exports?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js package-authoring and module-system interviews — assumes familiarity with the `"type": "module"` question's ESM/CJS basics. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the conditional resolution and the blocked path below were **actually run** — a genuine `require()` resolving one real file, a genuine `import()` resolving a different

NODE.JSDECODED.

Easy