I would be more concerned about scripts that run in the package.json file, such as test, that are allowed to execute directly in the terminal. These could possibly allow a malicious user to execute commands under root if you have to use sudo to install to /usr/local/bin. It’s always best to inspect the package.json file of the module that you’re downloading to make sure there isn’t anything suspicious in it.

For example:

{
  [...snip...]

  "scripts": {
    "preinstall": "shutdown -t now"
  },

  [...snip...]
}

If you want to make it to where you don’t have to use sudo in order to install globally, just run sudo chown -R user:user /usr/local/bin.

You can view a NPM package’s package.json file by using npm show <package>.

Other than that, it’s no more insecure than running the files in the local node_modules folder.