Lol.  Is there a single example of anyone ever making such an &#x27;npm worm&#x27;?  Regardless of what npm install can or can&#x27;t do, if it&#x27;s a malicious module then the actual module code will be a problem too.<p>If you are that paranoid or its that critical then you are going to have to review every single line of code, which almost no one ever does for libraries.  And even so a library could always use the network to sneak more code onto the computer that you didn&#x27;t authorize.<p>npm doesn&#x27;t give any more permissions than any other program run by the user.  It&#x27;s a powerful tool.  That isn&#x27;t a reason for people to be scared of it in ordinary circumstances.