Seems like the answer is "none" by default, from https://docs.npmjs.com/misc/scr...

insin on March 24, 2016 | parent | context | favorite | on: NPM and Left-Pad: Have We Forgotten How to Program...

Seems like the answer is "none" by default, from https://docs.npmjs.com/misc/scripts#user

> If npm was invoked with root privileges, then it will change the uid to the user account or uid specified by the user config, which defaults to nobody. Set the unsafe-perm flag to run scripts with root privileges.

xorcist on March 24, 2016 [–]

That's good, even if nobody is perfectly enough to a botnet. I thought more of the user running the node application.