If it produces no output, does that mean that there's no code that could act in the future?
I first acted out of nerves and deleted the whole node-modules and package.lock in a couple of freshly opened Astro projects, curious if I should considered my web surfing to still be potentially malicious
you can simply selfhost Plausible or other not-invasive analytics to see all aggregated info you might need. it will be 100% yours and compliant with all sorts of privacy laws and principles