I sorta understand your point, but this wouldn't help in the case of running that script. Namely, the JS sandbox of the browser already prevents filesystem acc

I sorta understand your point, but this wouldn't help in the case of running that script. Namely, the JS sandbox of the browser already prevents filesystem access. But a user running `node` in a shell would not be protected by the browser or the hardening of browsers you mention. You would need to manually setup those protections for your command which most people will not do. Similarly, Linux has filesystem namespaces, and tools like bubblewrap can achieve similar protections. Lastly, the real risk of the above is that code is easily runnable automaticly with an `npm install` and if you have private repositories than node/npm would still need access to private key (or maybe token for http) information to fetch them.