Agree with all of this, except I'd add Docker containers as a less severe step before going all the way to something like Qubes. Since the OP mentions Python and Node libraries, it's likely they're compatible with being run inside Docker containers, which should do a passable-but-not-perfect job at isolation.
