yeah but i mean installing an npm package in a container is giving it low privilege access