Switch to another user, idealy called 'npm'.

        su -l npm

Then, just in case, run it under bubblewrap so it just can use $HOME and nothing more.