Under the shared responsibility model, which of these is the customer's job for a Lambda function?

With Lambda, AWS manages the OS, the managed runtime and the hardware. You own your code, the packages you bundle with it, and the permissions you give it through its execution role. So keeping npm dependencies safe and scoping the execution role is your job.

"Patching the operating system the function runs on" is the tempting wrong choice. It is the customer's job on EC2, but not on Lambda. "Keeping the Node.js runtime's underlying OS libraries updated" and "Securing the physical hosts" are also AWS's job on Lambda.