Isn't the production deploy of the code dependent on all these modules even more important than the security of your random laptop? General practice is minimiz

Isn't the production deploy of the code dependent on all these modules even more important than the security of your random laptop? General practice is minimize dependencies, scan build directories by "malware scanners," pin dependencies, block unfiltered outbound access. Personally I find the last to be the most important - even if they slip a discord creds stealer or a coin miner into your system, if its endpoints aren't on your allow list, it won't hurt you. It does take some inconvenience to install an allow-list based proxy on your non-work machine, but is doable. Hopefully your work is doing that for your at some layer of the network. Another useful principal is that the laptop shouldn't really have any private or irreplaceable data on it. Push your code to GitHub, clean up the web browsing data, script installing all your apps and stuff that you use, and then the laptop is just a disposable network access point. Maybe have a passphrase protected SSH key for reaching VPS with important stuff. Open source dev should be possible to constantly twitch-broadcast it to everyone. Caveats I don't use node much at all, and am somewhat strict on being minimalist for python dependencies. My email is on my VPS and all my money is behind 2-factor. And I'll do more random web browsing on my tablet than on my laptop.