This solves only `npm install` and not other ways the package can be compromised. And you're still giving it plenty of access to any projects under your home d

This solves only `npm install` and not other ways the package can be compromised. And you're still giving it plenty of access to any projects under your home dir, or opportunities to modify other npm packages that are being installed, to gain execution outside of sandbox later on.