The biggest detractor of JavaScript isn't so much about its language’s:
- lack of strong typing (unlike Ada),
- lack of a standard framework (VueJS, NodeJS, Angular, React, Ember, Mithril, Aurelia, Backbone, Polymer)
- lack of consistent control of packaging (embedded or HTTP[S]),
- lack of consistent naming convention (wild west of competing function names, unlike libc library to name one language),
- lack of unit testing (JS? nah),
- lack of correctness for thread procedure theorem (unlike Nim, Ada),
- lack of memory access security (unlike Rust),
- lack of JMP/goto at lower intermediate representation (LIR) level (unlike many programming languages) thus making direct LLVM more difficult and the least portable.
- lack of robust error handling (unlike many)
JavaScript is a runaway language with not much forethoughts being put into server-side security that continues to must have
- a wider access to local filesystems,
- a large, shareable memory block capability set that allows for JIT switching between executable and writing, heap-spraying for kernel addresses, SPECTRE-like capabilitiies (that will continue to be fileless malwares’ favorite haunting ground for decades to come).
JS did however introduce a “stack-less” just-in-time compiler that is small enough to get embedded into so many things (my pet peeve is JS of LG smart-TV that is still borked to this day) that no one single anti-virus company can ever hope to cover all those bases.
But it’s common, and wide-spread, thus got its adoption rate going for it (much like BASIC variants did during multiple decades) but it sure ain’t going to be healthy.
Of course, just flapping off my mouth here toward the incoming tsunami of flotsam against my hardcore cybersecurity values.