Clean up `new-package/`

[lishaduck]

I haven’t read through the code enough here but there are many alarm bells ringing with the original code here:

1. String interpolation in a shell command. Is spaces in the interpolated value going to mess it up?
2. The use of npx.
3. The use of child_process directly – does it work on Windows?

Originally posted by @lydell in #100 (comment)

Additionally, not all of the files are checked by ts.