Yes... The only things I use from the JS ecosystem are {Claude,gemini}-cli which I fear will be compromised. Fortunately I run in them in their own user accounts with no e.g. ssh credentials, but I dead that's not enough especially for Gemini which probably has access to my entire Google account somehow.