Is it safe to use Node.js as the backend language of a hidden service?
Or is it a poor choice when compared to languages such as PHP and/or Python?
Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this communityNone of the 3 languages is perfectly safe. All of them have vulnerabilities that if an application is not developed following good programming practices, they can allow an attacker to exploit different weak points and gain access to the application and its data.
You can use any language you want, but you have to consider checking your application to see if it has vulnerabilities (you can use OWASP Testing Guide), here are some references that you may find useful, I selected references for the 3 languages you mentioned above.
PHP:
NodeJS:
Python: