There are some things you can do to make `rm` safer which would prevent this from working: https://github.com/sindresorhus/guides/blob/master/how-not-t...

Though the real fix is doing development in a sandboxed container.