Fortunately the problem could become more tractable if something like SES / Endo takes off: "Endo protects program integrity both in-process and in distributed

Fortunately the problem could become more tractable if something like SES / Endo takes off: "Endo protects program integrity both in-process and in distributed systems. SES protects local integrity, defending an application against supply chain attacks: hacks that enter through upgrades to third-party dependencies. Endo does this by encouraging the Principle of Least Authority. ... Endo uses LavaMoat to automatically generate reviewable policies that determine what capabilities will be distributed to third party dependencies." https://github.com/endojs/endo https://github.com/endojs/endo