Comment by mumblerino

By default, “npm install” also has the ability to run code after the installation, so npx is not any less safe.