Given the recent Claude Code remote access tool, it would be wise to not install any new software, or use any package manager for a few weeks as they could have already been silently backdoored during the aftermath of that incident.
Im now thinking about just running tart VM's on my mac to do my regular stuff from.
Despite no using full VM's I using Orbstack Isolated machines to some level of restrictions https://docs.orbstack.dev/machines/isolated for coding.