Comment by pikuseru

The thing that caught my eye immediately was the sandboxing. I have no idea why Node and npm don’t have sandboxing by default. It would greatly help with some of these worms and supply chain attacks.