A reminder from this month's npm supply-chain hit: your keys are only as safe as the machine they live on

A widely used npm package got hijacked this month and shipped an infostealer to anyone who installed it. It swept browser sessions, password vaults, crypto wallets and seed phrases, and even config files for AI coding tools, all from the machine it ran on.
The uncomfortable part for anyone in crypto: a seed phrase or a software wallet sitting on a connected dev or daily-driver machine is inside reach of whatever else runs there. The thing that stays out of range is a key that was generated offline and only ever signs offline, because it is not on that machine to steal.
Not saying any one setup removes all risk. Just that separating where you sign from where you browse and build is one of the higher-leverage habits out there. Curious how people here keep those two environments apart.