Deno has tackled some of these issues with their permission system, but afaik it can only be applied to apps, not to dependencies.

What we really need is a system to restrict packages in what they can do (for example, many packages don't need network access).