it would take a drastically differently designed execution environment to support meaningful library level sandboxing. After packaging/linking/bundling/compilin

it would take a drastically differently designed execution environment to support meaningful library level sandboxing. After packaging/linking/bundling/compiling etc depending on language/flavour often a library is indistinguishable from 1st party code, there is no boundary to sandbox. Without a large scale change, you'd have to fork a new process for each 'library' to create a process boundary to then sandbox, which is actually what you do sometimes (think firing ffmpeg or openssl or similar) but doing it for each library would be prohibitive, especially in NPM world where you blink and have thousands of libraries =)