It might, I'm not familiar but after a quick look it seems to operate on a vetted trust model i.e. you can use these because we checked and they are compatible. So you could miss out on a lot of the ecosystem.

I was leaning more towards the web approach where we assume everyone is out to get us, but they can't unless we give them that one permission they need. If it's a statically typed language then it'd even allow dependency walking to see what permissions are used at a granular level and we can decide not to bring in anything that's too loose. This of course won't solve cases like logic bugs, but it'd help mitigate the impact.

I'm just not sure if it's even feasible?

The checked and compatible stdlib is an extra provided by the project.

Deno runs code in a sandbox where you need to give permissions to scripts/modules for them to access local files, the network, etc:

https://deno.land/manual@v1.17.2/getting_started/permissions

Yes, but it's not granular. You either let all modules have permission X, or none of them.

I was thinking of their scoped permissions model described at https://medium.com/deno-tutorial/deno-security-65af9811d9c9

Not sure if you can scope down permissions as part of an module import or if it only works when you initialize the interpreter