I had a typo and npm installed something that is similar in name to something very popular -- I was concerned about typosquatting. It's quite plausibly legitimate and just a coincidence. I looked at the corresponding package and didn't see anything wrong, though of course bad things can be hidden.
I use nvm.
I npm installed it and then immediately noticed and rm'd node_modules.
How much damage can be done by just installing, without subsequently "using" it for anything?
I know very little about npm -- does npm allow the installation code to do whatever it wants on a system?