On linux realistically whatever user you installed the malicious NPM package with has access to everything you care about anyway.

Every user, since privesc is so easy on most operating systems.