Hacker News Reader

There's a reason I'll only ever run NPM in a VM on any machine that has any data I care about

Install scripts can be disabled with a config file, or npm flag, but your paranoia is not unwarranted.