`npm install` runs code as part of the initial step.
Also, `npm install foo` will of course not just run code from `foo` but from all its dependencies and their dependencies dependencies as well.