You can wrap node and its package manager into something like bubblewrap, which will remove access to basically everything but the project root directory (inclu

You can wrap node and its package manager into something like bubblewrap, which will remove access to basically everything but the project root directory (including your home directory with its browser profiles and ssh keys). I use this script with an additional seccomp filter that also denies access to privileged syscalls, but I don't remember where the filter came from, so I won't post it here — you won't be able to audit it easily as it's basically a compiled binary. https://0x0.st/8zWK.sh https://0x0.st/8zWK.sh Place the script anywhere and create symlinks named 'node'/'npm'/'yarn'/etc pointing to it, putting them into the start of your $PATH. Run your commands as usual. Use a 'bash' symlink to see what it looks like inside the sandbox. It's not as good as a VM, but much more convenient.