This is what I'm transitioning to. All third-party code runs in isolated containers: node/npm, python/pip.