> or, if not installed, will temporarily install it for the duration of the command. Wait... doesn't that make typosquatting even more of a danger? People get

> or, if not installed, will temporarily install it for the duration of the command. Wait... doesn't that make typosquatting even more of a danger? People get used to typing "npx <command>", they mistype the command once in a while, an attacker uploads packages named after the most likely typos, and done - the attacker wins. I question the wisdom of that shortcut.