Only install npm dependencies in a Docker container, e.g. dev containers offers an easy way to do that (the speed on macOS isn't great but hey)

Aikido scans all published npm packages in realtime: https://intel.aikido.dev/?tab=malware