It does not, supply chain attack is not that afaik. This is to defend against npm executing arbitrary nefarious code as your user on install of a compromised package.

Also sandoxing npm really means sandboxing node running npm (which is js).