CapLock is a cross-platform CLI that protects npm and pnpm projects from malicious lifecycle scripts. It intercepts scripts like postinstall and runs them inside a restricted sandbox with filesystem, environment, network, and child-process isolation