If you always run npm inside of docker does that pretty much prevent attacks like this?

Docker is not a sandbox. There is some work that can be done to harden it, but you're better off looking at genuinely sandboxing your dev environment