Generated TypeScript throws with frozen intrinsics

[kriskowal]

When running the compiled JS in the presence of a frozen Function.prototype, this module throws on initialization Cannot assign to read only property 'constructor' of object. This is because the TypeScript compiler, when targeting ES5, uses property assignment to replace the prototype.constructor.

The motivation for freezing all of the shared intrinsic objects is that, in conjunction with compartmentalization of third-party dependencies, it is possible to mitigate some classes of supply chain attack. https://github.com/endojs/endo/tree/master/packages/ses#secure-ecmascript-ses

This can be solved with a change and possibly an upgrade to the TypeScript compiler, if they are amenable to the change. https://github.com/microsoft/TypeScript/issues/43450

This can alternately be solved by either

• moving the language target up to ES2015 (which is technically a breaking change), patching after-the-build (messy),
• or creating a secondary build target for ESM and multiplexing package.json with a module property (for RESM https://github.com/standard-things/esm) and an imports property (for Node.js 12+).

[SBoudrias]

This package not being maintained anymore, and being a core dependency of Inquirer, I went ahead and forked it over at https://www.npmjs.com/package/@inquirer/external-editor - I've maintained Inquirer for >12 years and its one of the most popular package on npm; so I think that project is trustworthy new owner.

It drops tmp in favor of node built-in, the interface for the v1 release is backward compatible to ensure an easy drop-in replacement for folks running into the CVE issue. (v2 onward could contain breaking changes as I modernize the codebase and simplify the interface)