I noticed it in https://github.com/semantic-release/github/blob/7d64dbbc83496db2fef0a4fb419a554106e226a6/package.json#L45, haven't had the chance to check other projects yet. A few reasons:

1. node:fs is sufficient for modern Node versions.
2. cpy pulls in relatively many transitive dependencies, including is-number.
3. The author himself recommends against using the package.