How does Node.js v25's granular permission model prevent supply-chain attacks?

--permissions=network,read-only flags sandbox modules by default blocking filesystem writes. navigator.permissions.query() enables runtime policy negotiation for third-party deps. WASM modules execute in isolated permission scopes automatically. Audit logs track permission escalations for compliance. Blocks child_process.spawn() in npm dependencies.

Example:-

Code

node --permissions=network,readonly app.js
navigator.permissions.query({name: 'filesystem-write'}).then(r => {
  console.log(r.state === 'denied' ? 'Write blocked' : 'Write allowed');
});