When a project's installation instructions start with npx some-tool init , what's your first instinct?

If you've been in software for more than five minutes, it's skepticism. And for good reason: the npm ecosystem has suffered through supply-chain incidents, typo-squatting attacks, and deeply nested dependency trees where a single compromised sub-dependency in node_modules can exfiltrate API tokens or compromise your environment.

Some statusline setups put the package manager straight into the refresh loop:

"statusLine" : { "type" : "command" , "command" : "npx -y untrusted-statusline@latest" }

Enter fullscreen mode

Exit fullscreen mode

Or worse: piped shell scripts ( curl -sL ... | bash ).

In Google's Antigravity CLI ( agy ), the statusLine command runs on every refresh , many times an hour while you work.…