Could the solution just be to audit the permissions your dependencies require? Sure, it gets murkier with transitive deps like your http.js and number-is-even.j

Could the solution just be to audit the permissions your dependencies require? Sure, it gets murkier with transitive deps like your http.js and number-is-even.js example, but I would argue that this scenario isn’t as dangerous as it seems because it adds an opportunity for the middle-man-dependency (http.js) to catch overreaching permissions. With node, it is very opaque. With deno, as I see it, http.js can easily check the permissions for number-is-even.js, and you can easily check the permissions of http.js. It’s not perfect, but I think each link in the dependency chain is at least more easily auditable, even if it is not strictly more secure.