This sounds so incredible dangerous, OTOH there is no difference to curl | sh.

While `wasm-exec-webapp` isn't a real thing, if it's sandboxed as it would be, there'd be no difference, security wise, between that and going to a webpage in your browser

Remember ActiveX?

I mean when you navigate to any website you’re basically doing curl | v8 and trusting that the sandbox works.