Npm is a random executable that happens to be common. It can run arbitrary code and linux userspace is basically beyond useless in securing anything meaningful

Npm is a random executable that happens to be common. It can run arbitrary code and linux userspace is basically beyond useless in securing anything meaningful about itself. That Documents/FamilyPhotos album? Completely read-writable, I can just send the whole content to any IP address. One might say that you can run it in firejail or so, but noone does it. But here comes the graphics-related problem: even with firejail, any X program has basically unrestricted access to your whole screen and every key event without any form of security. This is basically unsolvable without nesting x sessions, or.. throwing away the whole of X and starting afresh with better primitives, a la wayland.