How about something like OpenBSD's pledge(2) system call [0] for Node? First: everyone decide on a set of potentially dangerous things for a program to do. Thr

How about something like OpenBSD's pledge(2) system call [0] for Node? First: everyone decide on a set of potentially dangerous things for a program to do. Three examples off the top of my head: disk I/O, accessing the network, executing external programs. A function could declare that it will only do some subset of potentially-dangerous operations, and an exception will be thrown if either it or anything further down the call stack does any of the others. In this particular case it seemed to be some post-install build script that caused it - but if this was present in the Node core would it be that difficult to implement in npm (i.e. "my post-install script and its dependencies will only ever do disk I/O")? If this is possible, and if it was adopted in the community widely enough, this would halt the imminent "some thing I depended on depended on something else that depended on a string function that turned into a credentials hoover" apocalypse... [0] https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2 [edit: very tiny clarification]