NPM install is arbitrary code execution. We give it a disposable VM