Using a preload script to safely expose select Node APIs to remote web content. See https://mixmax.com/blog/turnkey-electron-apps-with-meteor#safe-native-bridge for more information.

1_preload.js

// Local variables will not escape the preload script.
var shell = require('electron').shell;

// Global variables _will_ escape the preload script, except for globals injected by Node,
// like `require`—-those will be deleted after the script is done executing.
Electron = {
  openExternal: function(url) {
    shell.openExternal(url);
  }
  // Notice we don’t save `shell` as a property of `Electron`! Then it’d be available
  // to the webpage.
};

2_content.html

<script>
  // Successfully uses the `shell` module as prescribed by the preload script.
  Electron.openExternal('https://mixmax.com/download');

  // Logs "Uncaught ReferenceError: shell is not defined(…)"
  shell.moveItemToTrash('~/Documents');
  
  // (Ignoring previous line) Logs "Uncaught ReferenceError: require is not defined(…)"
  require('electron').shell.moveItemToTrash('~/Documents');
</script>

nice

// Global variables _will_ escape the preload script, except for globals injected by Node,
// like `require`—-those will be deleted after the script is done executing.

Note that require is actually a local in Node, though it does have globals like process.

skeggse: By global, do you mean an equivalent that works in browsers?