Notices by Verfassungsschmutz :sonnenrad: (verfassungsschmutz@nicecrew.digital)

Right, that's why I said it's safe IF you use a local Python installation from a legit source (i.e. MS Store on Windows or your distro package manager on Linux).

But node doesn't have a built-in webserver (although it's trivial to write one), so running any node commands will definitely execute some sort of custom code. I looked at the repo, and in this case, npm run serve:dev will execute this package, which is downloaded when you run npm ci (short for clean-install).

It's likely safe, since it has a high version number, millions of downloads per week, and no updates in 4 years (meaning it's stable), but in general, this IS a possible attack vector, even if the package author is trustworthy – a few years ago, someone managed to hack a guy who owned hundreds of popular NPM packages, stole his keys, and used them to upload modified versions of some of his packages that contained malware, which would try to scan the system for API keys and login info for various web services and send them to a server he controlled, so he could start mining crypto on their AWS accounts or whatever.

So if you want to be on the safe side here, I'd say stick to the Python version, and make sure you use an official Python distribution.