Comment by naugtur

Here's a tool that protects you from these kind of things without the necessity to set up an environment per project, just simple one-time install.

https://github.com/lavamoat/kipuka

It's an upcoming part of the LavaMoat toolkit (that got on main page here recently for blocking the qix malware)