Malicious packages may overwrite any file in the system:
https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/