Hacker News Reader

I only said it is a defense-in-depth measure.

I definitely want to know how is it worse than running npm directly on the host

Those aren't the only options, my dude.

And what are good options that you use and that work on Linux as well as Mac OS?