The interview context makes it worse. You’re trying not to look slow, so you skip the part where you ask whether you should run it at all.

At least now there is a blog post that you can link to and say "Sorry, but I don't run npm install locally because of the risk of phishing attacks."

A skilled employee would never skip that step, why should you do so in an interview context? Skipping that step seems like a task failure to me just as much as any other part of the question from an interviewer perspective. Maybe I shouldn't hire the guy that blindly runs code just because someone "senior" to them asks.