I think this needs to be solved at the OS level, not the language level. It's a problem for every language -- packages you download can write to any file or ma

I think this needs to be solved at the OS level, not the language level. It's a problem for every language -- packages you download can write to any file or make network connections. It might be a little worse in NPM because of the culture, but the problem is pervasive. Personally I'm interested in the direction of lightweight containers that behave like executables, and that have composable dependencies. Developing in Docker-like containers can work but there are a bunch of downsides to be mitigated. (copy of lobste.rs comment)