You don't even need containers on linux. If SELinux was more accessible, this would be a very cool use case. You could set the security context of your NPM acc

You don't even need containers on linux. If SELinux was more accessible, this would be a very cool use case. You could set the security context of your NPM access credentials to something other than unconfined and ensure that only processes with a specific security label can access files tagged with that security context. These security labels in term are kernel controlled. So at that point, a malicious install script needs to escalate to root in order to steal your credentials. It's kinda sad how such a powerful and rather simple tool is so hard to use.