Can you delete system32 with node?

Question

1. On windows 7 and above is it possible to delete system32 with node and wreck the system?
2. Is the folder protected somehow?
3. Do you need to launch the script with admin permissions or something?
4. How would a code like that look like?
5. And if it's possible, is it also possible that a random npm package can contain such malicious code?
6. I've been kinda careless downloading npm packages, should I worry? Just curious, obviously :p

Answer 1

1. Yes - provided your node.exe is running with Elevated permissions (aka "Administrative" permissions)
2. Yes, the folder has NTFS ACL permissions that require elevated permissions to delete, move and rename. Additionally the directory is Owned by the built-in principal TrustedInstaller.
3. Yes, as described in answer 1.
4. Invoke the Windows command-line utility runas. There is also an npm package which wraps this for you: https://www.npmjs.com/package/runas
5. Yes, it's possible for a malicious npm script, or any Node script - or indeed any program at all, to make that call - however provided you have UAC enabled you will receive a full-screen prompt to confirm elevation.
6. No, don't worry - provided you have UAC enabled you'll always be prompted first.