Ask HN: How do you securely develop in Node or Python?

I'm new to using languages that pull down 100 packages to my development environment from third parties. What is best practice here to avoid my development environment getting exploited? Run everything in a VM?