This is wild to me, not just because they're a developer but they even know about SPF/DMARC. Also, the content of the email being them asking to reverify your email sounds suspicious and illogical. I know people make mistakes, but it's just crazy, and shows the importance of companies training employees to not fall for phishing emails.

Use a better package manager that always disables installation scripts and lets you whitelist only those you absolutely need (like pnpm — which asks you post-install if any scripts were necessary, and reruns those you confirm).

Also avoid horrible tire fires like eslint that require several hundreds of unvetted dependencies. If you work alone and are disciplined, it's perfectly possible to write good TS without a linter. If not — use biomejs.dev (zero external dependencies) or `deno lint`.

Also node can easily be isolated from the rest of the system through bubblewrap/firejail:

  $ ls -a ~
  .  ..  code

https://wiki.archlinux.org/title/Firejail

It's the primary way suggested to integrate the two https://prettier.io/docs/integrating-with-linters