Yes (assuming they're doing frontend dev and including the resources from the page). The code is fetched and executed from the browser, so It'll have to escape the browser sandbox to do something nefarious.
replyYes, none of npm's lifecycle hooks. You're just pulling bytes over the wire.
replyExcept now you're making http calls to remote servers that could be compromised.
replyCan be mitigated, as the sibling comment points out, but even in the situation you described, the blast radius is reduced, especially for frontend libs.
replyAs long as you embed it with an SRI integrity hash, you're safe, even if the remote server is compromised.
reply