[nautilus12]

If you always run npm inside of docker does that pretty much prevent attacks like this?

[mfro]

Docker is not a sandbox. There is some work that can be done to harden it, but you're better off looking at genuinely sandboxing your dev environment

[ashishb]

What is genuine sandboxing? Everyone waives there hands by saying this