> So you think it is okay for a single npm install to fork a process and continuously query the clipboard and without any sort of notice just upload it to some random server? Or, even just log every single keystroke you press? Hell, it can even take screenshots of everything.

No, I don't think it's "okay." I just think it's indistinguishable from running arbitrary code, which is much worse anyways.

Again, ask yourself: what is the specific threat model in which an attacker can run a process that continually polls the clipboard, but can't do anything else?

> Afaik macOS doesn’t allow clipboard access in that naive way and you do get access in wayland, it is just not this “uncontrolled”.

You can try this for yourself: the `pbcopy` and `pbpaste` utilities on macOS allow uncontrolled access to the clipboard without any entitlements. These are well-known utilities that are baked into macOS, and are widely used by tools like password managers to programmatically control the clipboard.

More generally, you can look up the NSPasteboard and UIPasteboard APIs that Apple offers on macOS and iOS. There are no special entitlements required for either.