[kaba0]

Yeah, even a package install, or npm invocation could easily install a keylogger with full network access, or go over the file system and encrypt it.