I would hope that someone deliberately choosing to run a headless Debian install would be wise enough to not go around running `npm install` willy nilly. In my personal experience, I've never once needed an `npm install` in Debian environment. I've only ever used them in server environments and to be honest thinking about it, that was all pre-npm when javascript was kept where it belonged in your browser and not my server. Someone screwed us all allowing JS on the server, but that's an entirely different conversation.

Well, it's enough to use a trusted app as your own user on non-trusted data. The former just has to have a memory vulnerability, which is not rare given most of it is C.

So yeah, don't be so confident in it working out. Unfortunately gnu/linux desktop is severally lacking in security (and by desktop I mean a headless personal use as well)

I used to run npm install unsupervised from a script on headless Debian that I deliberately chose dozens of times everyday. Later I moved my CI to Alpine.