node.js – What are the risks of installing (running) foreign npm modules? Can we limit the risks?

An npm package (like any library/software) has the full access to whatever environment you put it in. If you can do it in Node.js, an npm package can do it.
As a package manager, npm can effectively put a file anywhere (ex. an malicious executable) and when a function is called it can do whatever it was programmed to (ex. execute the malware).

Software auditing is real, and a major push is being done by various Open Source groups to help make sure that software doesn’t have any critical flaws (intentional or otherwise). Before you install, find the package.json file and give it a read, if something seems suspicious you might have to dig deeper (ask a dev or community member for help). If the software is open source look for audits (or audit yourself).

There are some suggestions listed in this Medium article: medium.com/@nodepractices/were-under-attack-23-node-js-security-best-practices-e33c146cb87d

Recommendation: Try to be a white hat hacker. Check out the technology and try to infect your own machine with some malicious code you made, then see if there’s a way you could have avoided it.

Source:
docs.npmjs.com/files/package.json
docs.npmjs.com/cli/install