> We now use QuickJS, a JavaScript VM written in C and cross-compiled to WebAssembly.

https://www.figma.com/blog/an-update-on-plugin-security/