At this point, is there an obligation of package managers, or at least npm to arrange the sandboxing themselves?

Or as us or companies to wrap the build tools to provide the wrapping for them.