+ deno's file-system permission model is the answer to recent malicious npm packages fiasco:

"deny access to ~/.ssh and other important folders" --> that alone would likely have 99.99999% sterilized most "hacks"