Stop Trusting npm Scans: Run Untrusted Packages in an Isolated AWS Sandbox

Static scanners read npm packages without running them, so they miss the postinstall that only fires at install time. I gave my AI agent one tool that runs the install in a disposable AWS CodeBuild sandbox and catches the curl | bash from the real build log.