Comment by ashishb

The archaic model where every tool gets full access to your home directory was never designed for the scenario where a single npm install will install and execute 100s of packages written by various authors.

One should sandbox all npm command executions.

https://github.com/ashishb/amazing-sandbox