What if it puts malicious code into test file and you allow `npm run test `?