new-project

This module is not overtly malicious by itself; it is a thin CLI wrapper that executes third-party npm code via npx in the context of a detected repository root. The dominant risk is supply-chain execution: the default uses an unpinned moving tag (@latest), and the --package argument directly controls what gets fetched/executed without pinning/verification/allowlisting. The subprocess also receives all inherited environment variables (only telemetry is forced off), increasing the impact if the executed package is hostile. Treat this as a meaningful security risk requiring package pinning/integrity controls and restriction of allowed package specs in a security-sensitive threat model.