I do believe that npm and pip packages should be regarded as potentially compromised if you don't check the dependency tree regularly (don't believe anyone does that tbh). The solution isn't moving into the cloud though, that would probably expose you more than a local machine.

Put your work into a VM if you want a layer of security and separation. Personally I don't do that. I have a VPS (they are very cheap) but I never thought to use it as a platform for development. I use it to host my projects there for myself mostly. Perhaps monitor the traffic, but this is tedious as well.

Otherwise you need to check you dependencies. If you do not do that you don't want to offer your software to others anyway.