But that thing probably fits on few floppies and don't even know about npm, so there are not a lot of moving parts and there is no fear of malicious npm package

But that thing probably fits on few floppies and don't even know about npm, so there are not a lot of moving parts and there is no fear of malicious npm packages ever. What's _technically_ wrong about that?