How do you see secure package management? What extra security would you add? As I see it people want to use the code third parties control but without trusting

How do you see secure package management? What extra security would you add? As I see it people want to use the code third parties control but without trusting them somehow. Package management alone can only go so far. Code just has too much privileges in a language like javascript and no matter what you do something coming from third parties can pwn you or at least facilitate that. There needs to be a language where code doesn't have so much privileges. Imagine if the language only allowed to import functions that either have no side effects or each side effect required explicit security token, say for reading some file or connecting to some remote host. Instead of passing strings around and let any function have unlimited privileges to read any file, the code would pass security tokens around that let functions only read specified files. Think language level capability-based security. I can't think of anything else that can help with random third party code.