I have solved this by refusing to use anything involving node or npm. We had one project kick off with that and it was a lesson in supply chain attacks within a week.