Every NPM turd should be run with bubblewrap or a similar sandbox toolkit at least.