Given the number of supply chain attacks via npm, maybe the recommended approach to use should be pnpm instead of npx.