title: Do Node.js global modules override PATH?
body: <p>Given a package X with declared executables at certain <code>package.json</code> section:</p>
  <pre><code>{
    &quot;name&quot;: &quot;example-malware&quot;,
    &quot;bin&quot;: {
      &quot;sudo&quot;: &quot;./spoof.js&quot;
    }
  }
  </code></pre>
  <p>Can <code>PATH</code> commands or even shell builtin's be overriden? If yes, may there be a security threat to local system packages?</p>