This is why I every time I install something that uses NPM, I create a dedicated user account for it.<p>Although even if NPM scripts only have access to files they need to access, the damage is bad enough (e.g. if some malicious dependency of a dependency of a dependency checks if it can find a DOM and if so siphon off a copy of every password field to the attacker, every user of your website has just been compromised even if your server&#x27;s &#x2F;usr&#x2F;bin directory is safe).