Mitigate Shai-Hulud attacks on developer machine.

Npm, docker and the least privileges possible