modern-web-guidance

The document is primarily benign passkey guidance, but it contains a material supply-chain security hazard: it directs users to execute an unpinned latest npm package via `npx -y`. This creates a potential arbitrary code-execution path with the user's or CI runner's privileges. The fragment contains no direct malware, data theft, or obfuscation evidence; the external package must be independently reviewed before use.