"bin": { "/usr/bin/date": "./fake-date" } The only way that can do anything scary, is if you are running `sudo npm install -g <untrusted package>`, and at that

"bin": { "/usr/bin/date": "./fake-date" } The only way that can do anything scary, is if you are running `sudo npm install -g <untrusted package>`, and at that point you should already be terrified. Don't do that. This is no different from any other package you install from any third party. The author of the package is the relevant third party here, npm is just a host, they don't do your security homework for you. (Think "github", not "Debian".)