3va: The Permission-First JavaScript Runtime Built in Rust

Recent npm supply chain attacks (xz, event-stream, node-ipc) have exposed the inherent risks of executing untrusted code at install time. 3va addresses this fundamental vulnerability with a permission-based security model where every capability—filesystem access, network, environment variables, and subprocesses—is blocked by default and only granted through explicit flags. Unlike Node.js, Bun, and Deno, it unconditionally blocks postinstall scripts while maintaining full compatibility with the existing npm ecosystem and popular frameworks.