Actually the installed code may have less permissions and may execute in a different context. For example, an npm js library for a photo gallery may only ever r

Actually the installed code may have less permissions and may execute in a different context. For example, an npm js library for a photo gallery may only ever run in the context of the browser. Of course some libraries for server code / build code may run in node js which ostensibly allows for ACE. But the surface area is smaller with this.