Ideally we'd just keep each mod in a separate
lua_State and make mods pass data amongst themselves through a Minetest API. This would improve security and probably make mod-level multithreading easier, but it would break just about all mods. Without this we're limited to a "best guess" as to what mod is running. During init time this guess is fairly accurate, but after init time it's a mess.
For example, even at init time I think the following sandbox escape is possible (although I haven't actually tested it):
minetest.conf: secure.trusted_mods = trusted mods/trusted/depends.txt untrusted mods/trusted/init.lua: untrusted()