I would be more concerned about scripts that run in the
package.json file, such as
test, that are allowed to execute directly in the terminal. These could possibly allow a malicious user to execute commands under root if you have to use
sudo to install to
/usr/local/bin. It's always best to inspect the
package.json file of the module that you're downloading to make sure there isn't anything suspicious in it.
"preinstall": "shutdown -t now"
If you want to make it to where you don't have to use
sudo in order to install globally, just run
sudo chown -R user:user /usr/local/bin.
You can view a NPM package's
package.json file by using
npm show <package>.
Other than that, it's no more insecure than running the files in the local