The interview context makes it worse. You’re trying not to look slow, so you skip the part where you ask whether you should run it at all.

At least now there is a blog post that you can link to and say "Sorry, but I don't run npm install locally because of the risk of phishing attacks."