I would imagine installing directly as a regular user is the _typical_ approach, and even more-so for beginners.
I don’t see any recommendation in the nodejs or npm docs for any other approach.
It may be commonsense and obvious to you, but I would be really surprised if commonsense and common practice overlap significantly in scenarios like this for all but the most security conscious.
