Running npm install is a reflex at this point. You see a progress bar, a few hundred dependencies fly by, and the lockfile updates. You move on to the next task.But that command isn't just a file transfer. It is execution. And it runs with the same user permissions you use to check your email or push to production. The most dangerous code on a Linux system may execute before your application even starts.The recent npm supply chain attack on the Axios library showed how easily a postinstall script is weaponized. By exploiting npm lifecycle scripts , attackers turned a trusted utility into a delivery mechanism for a remote access trojan (RAT). This isn't about a bug in the code. It is about how the installation process is designed to work.

Source: The npm Supply Chain Problem: Why Installing Packages Executes Untrusted Code