Nothing gets installed until it has cleared customs.

Pick a sample shipment or name any npm or PyPI package. An analyst agent on Vultr Serverless Inference reads the code and writes a harness. The package is then installed and exercised inside a gVisor sandbox that has decoy credentials planted in it and no route to the internet. You get evidence, not opinions.