Others have noted Deno has good protections around this, but I would add that it has those because running a package from NPM is in and of itself just executing

Others have noted Deno has good protections around this, but I would add that it has those because running a package from NPM is in and of itself just executing code from a random URL, and that has caused plenty of problems in the past.