Malicious packages may overwrite any file in the system: https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/