What I don't understand, how come there are no automatic red flags/or permissions when a deep dependency attempts to write on desk or make network calls? I mea

What I don't understand, how come there are no automatic red flags/or permissions when a deep dependency attempts to write on desk or make network calls? I mean in theory any npm package could have a payload that would hijack the machine or override other system functions, where is the security in any of that?!