You're good to keep your skepticism. If you trust them, the ones creating the tutorial to have vetted to a degree, or that a very popular package like that is vetted to a reasonable degree, you'll just go ahead with it. (Like most people do without questioning it.)
You'll need considerable experience and insight to do good, reasonable risk assessment. Without that, you can either trust and hope in others, or skip the ecosystem and look for alternative technologies.
It's also worth noting that your potential impact is considerable lower if you're only doing local test and development work, not publishing or publicly serving anything. I'm not personally familiar if or to what degree running arbitrary local commands has been limited in the npm ecosystem by now.
If Markdown formatting is enough for you, I would look into using a static site generator, like Hugo or Jekyll.
If you want to keep your existing content as static files but same website skeleton and layout instead of copying and editing files you'll copy one and create the layout template. Then content and new posts and pages can be generated from Markdown files. If you set up CI they won't need to run Hugo or what you're using, only push the Markdown files to your Git repository.
Whatever you want to do primarily depends on: Your formatting, styling, functionality, and interfacing needs for the editor, and what you're willing to use or invest for setup.
Hugo runs from a single binary. The source layout is reasonable. With a single layout the folder structure doesn't have to be complex.
I'm not very familiar with alternative [Markdown] static site generators.