To not use npm. Or create a package manager like npm. Or believe in philosophy that we should have as many small dependencies as possible.

If you must use npm, containerize/VM it? treat it as if you're observing malware.