Install scripts can be disabled with a config file, or npm flag, but your paranoia is not unwarranted.