Client sent me code to run locally is it malware?

What people tried

Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.

1. 1
   Running client projects inside isolated, hardened containers or virtual machines
2. 2
   Using tools like npx npq to precheck dependencies
3. 3
   Developing on a secondary throwaway laptop or rare operating system
4. 4
   Refusing to run unfamiliar repositories and walking away
5. 5
   Disabling the Run hotkey via registry keys or configuration policies
6. 6
   Restricting user access to PowerShell and command prompt through Group Policy Objects
7. 7
   Deploying endpoint detection and response tools to automatically flag and quarantine malicious executions

In their words

Unedited, most upvoted first, each linked to the thread it came from.