An agent running npx without a version pin can silently scaffold an old project. Since npm 10.8.2, npm-pick-manifest v9.1.0 prioritizes engine-compatible versions over the latest tag. On Node 24, npm skips v2.0.0 (engine upper bound excludes 24) and falls back to v1.3.0 with no engines field.
Tap to vote and see what everyone thinks.