Yes! For instance stealing all your SSH keys and shell history, eg. by some node module down the dependency tree.