The thing that caught my eye immediately was the sandboxing. I have no idea why Node and npm don’t have sandboxing by default. It would greatly help with some of these worms and supply chain attacks.
The "VM-isolated sandbox" is apparently not referring to the JavaScript VM but to a hypervisor, according to the text a bit further down on the page. I wouldn't expect that to be particularly fast or efficient, especially not if you're already running in a VM and have to use nested virtualization (if it's even available).
Is it essentially implementing a paravirtualized OS that runs the JS runtime? Presumably you have to allocate the memory for the VM up front, or how does that work?
on linux its kvm, on darwin its hypervisor.framework, the memory is not upfront, by default 256mb is lazy allocated, and ~35mb are used by both ant + the vm. the kernel is https://nanos.org with patches to get ant+networking running smoothly