JavaScript Error: TMP.NODE was prevented from running

[devsides]

Is it a bug?

• I know this is an issue with the app, and contacting Mullvad support is not relevant.

I have checked if others have reported this already

• I have checked the issue tracker to see if others have reported similar issues.

Current Behavior

JavaScript Error:
Program was blocked from running by group policy.

Expected Behavior

Should run...

Steps to Reproduce

I was able to replicate this on another Windows 11 system.

1. Enable AppLocker:
   gpedit.msc > Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker
2. Add default rules:
   Right click on each and create default rules for all (Executables, Windows Installer, Script, Dll and Packaged app rules).
3. Enforce:
   Right click AppLocker > Properties > Check "Configured" and select "Enforce rules" for all.
4. Run app > Error.

---

5. In the properties change DLL rules from "Enforce rules" to "Audit only".
6. Run app > Warning in Windows Event Viewer:
   Event Viewer > Applications and Services Logs > Microsoft > Windows > AppLocker > EXE and DLL:
   %OSDRIVE%\USERS...\APPDATA\LOCAL\TEMP....TMP.NODE was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Failure Logs

%OSDRIVE%\USERS\...\APPDATA\LOCAL\TEMP\....TMP.NODE was prevented from running.

Operating system version

Windows 11

Mullvad VPN app version

2025.4.0.0

Additional Information

Admin prevents executables from running in the Temp folder for "malware prevention" and "attack surface reduction".
Software is installed in the program files folder and there are publisher specific rules enabled for updates.
I can install but not run the new version (2025.4.0.0).
Previous versions installed and ran without issue.

[devsides]

I found the same issue identified in other apps.
It seems you need to add "asarUnpack": "**\*.node" to the electron-builder configuration so that the <guid>.tmp.node modules are unpacked next to the executable.

---

Ref:
https://forum.obsidian.md/t/tmp-node-files-malware-alarm/4743

brave/browser-laptop#12534

"When you spawn a child process from a file within an asar container, Windows copies it to a temp folder to be executed because it can't run it from within the container."

"the electron-builder smartUnpack function was detecting things like the ssh2 module and correctly putting it in /resources/app.asar.unpacked/, but not sqlite3. On each run, the executable file was copied out of the asar and put into %appdata%/Local/Temp as .tmp.node."

"In our case, adding "asarUnpack": "**\*.node", to the electron-builder configuration adds the sqlite3 module to the unpacked folder and the temp file is no longer created on each run."