You don't have to write Lua. As you've already said in a different comment, it isn't a problem in QuickJS because it has memory limiting built in. IMO that's the right way to do this - instead of transpiling JS to try and make it safe you should run it in a virtual machine like QuickJS/Lua/etc does.