Chore: Untrusted Dev Machine (`Node.js` Sandbox)

Sadly, I **no longer _trust_** anything built with **`Node.js`**. 🙅‍♂️ (_and neither should you...!_ 😬)
Not saying this from a "consumer" perspective, but rather as an engineer/developer. 🧑‍💻
_Running_ code written by random strangers has always been a matter of **trust**. 🤝🏻
Increasingly there are [**Supply Chain Attacks**](https://en.wikipedia.org/wiki/Supply_chain_attack) targeting **dependencies** of popular packages. 😈

> e.g: https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem 🏛
> Or `Reddit` if you prefer: https://www.reddit.com/r/node/comments/1rin5bm/supply_chain_attacks_via_npm_any_mitigation/ 🤔
> Even the `NHS` is alerting about this: https://digital.nhs.uk/cyber-alerts/2026/cc-4781 👩🏻‍⚕️

This means **malicious actors** are _succeeding_ at injecting evil code into **dependencies** ☠️
which then infect/hack the host machine (e.g: **developer's laptop** or ***server***) 💻
and steal credentials, crypto keys, etc. 💰

> **Note**: If you **_aren't yet_ paranoid** about **system security**, 🔒
you either (_naively_) _think_ you "_don't have anything to lose_"
or "_it won't happen to me_" ... until it does!
So _learn_ to be **_proactive_** with your **security**.

# It's Going To Get _Much_ Worse! 😬

"_AI agents uploaded malicious packages to `RubyGems`_":
https://www.reuters.com/legal/litigation/openai-agents-attacked-software-service-rubygems-before-hugging-face-incident-2026-09-11/
What this means is:
1. **`Ai` labs** are going to release proof-of-concept malicious code into public package management repositories to showcase what their models can do. Yes, even if it results in **lawsuits**, they will still do it and _pretend_ it was [unintentional](https://news.ycombinator.com/item?id=49696232).
2. **Malicious actors** are going to use both Open and Closed models to do similar malicious code injection into packages. 📦
3. **`GitHub` accounts** will be **compromised** by malicious code running on the Dev's machine and used to submit **PR**s that _appear_ to come from **legitimate people** but are in fact malicious. 💀
4. The **cycle will `continue`** until _everyone_ in the target ecosystem is infected or whatever malicious goal is achieved. 🏴‍☠️

# Todo

+ [ ] Revive `Mac Mini M1` (recent Mac that is fully supported with **latest `macOS`** and **security patches**) ⏻
+ [ ] Setup on dedicated desk 🖥️
+ [ ] Connect to DMZ internet (not `@home` network) 🛜
+ [ ] Figure out how to isolate any node projects I run on the machine, e.g: sandbox with [`Docker`](https://github.com/dwyl/learn-docker)? 🐳