No, not really.
On my dev system, I will npm install something.
When I am ready to capture my changes, commit to my dev branch and push.
Now a test system can run it.
Only then will my changes be merged to production.
There is no reason for you to not go through a test system with your changes first.
The malicious code would have dropped a payload only on my system and performed it's own housekeeping.
My prod system would not have been affected.