The event-stream incident has made it clear that the JavaScript module systems are broken. This is where we fix it.
This space is for discussing solutions and joining each other’s efforts. A wide variety of solutions are discussed, but they have two things in common. First, an effort to ensure that modules are loaded with “least authority,” meaning that if a module doesn’t need access to the file system or the network, it shouldn’t have access. Second, using as much of an object capabilities (ocap) approach as possible, or explaining why another approach is better for that particular problem.