One package can attack by declaring a malicious executable (bin) with the same name as one from a package that you would intentionally use.

Second:

If the malicious package is installed globally, it is injected into your regular PATH, and can similarly "hijack" regular commands.

-

At first I read tfa and said "and? Thats what I expect it to do". Then I noted:

* for a given package installation, a dependencies dependencies bins are available. This is generally counter intuitive.

* conflicting bin entries do not generate warnings or errors.

On a personal note: - I dont install node modules globally. Wrt development it should stay in repo, and I'm not a fan of managing system utilities from anywhere other than my distros package manager.. largely because its a PITA (I'm looking at you Python). - I cant think of any reason why non top level dependencies should have their bin files exposed. That is madness. - if it was just top level files, this would be a meh - I should get a conflict warning but I (or my cocontributors) deliberately installed those packages, so im not too bothered there.