if the thread was npm malware, having your dev instance inside the VM would reduce the fall out. Your personal & prod creds would be outside the VM. It still g

if the thread was npm malware, having your dev instance inside the VM would reduce the fall out. Your personal & prod creds would be outside the VM. It still goes a long way to reduce fallout with minimal effort & discipline. You’re right it’s not perfect security, VM still needs securing – but it’s a good ROI