We need a permission system for packages just like with Android apps. The text coloring package suddenly needs a file access permission for the new version? Seems strange.

Deno has taken steps in this direction. It’s probably doable for pure js packages, but nearly impossible for packages with native extensions.