> I would guess worst case QuickJS probably can compile to WASM

That's actually exactly what Figma is doing for their plugins. [1] Seems to be working ok, though not without some pain [2].

[1] https://www.figma.com/blog/an-update-on-plugin-security/

[2] https://macwright.com/2024/03/29/figma-plugins