I locked every package manager in a container so a malicious dependency could never touch my credentials. Then I sat down to write a blog post about how well it worked, and found out it didn't. This is that blog post. It's a bit different from