Your agent just scaffolded a project from 2020

An agent running npx without a version pin can silently scaffold an old project. Since npm 10.8.2, npm-pick-manifest v9.1.0 prioritizes engine-compatible versions over the latest tag. On Node 24, npm skips v2.0.0 (engine upper bound excludes 24) and falls back to v1.3.0 with no engines field.