#1145 temporarily removed the usage of npm-registry-fetch (reverting to using the npm CLI) due to a vulnerability in older npm-registry-fetch's old tar dependency. Updating npm-registry-fetch would require a bump of Beachball's minimum Node version to 18+, which shouldn't be done outside a major release.