Your reported issue is just about the fact that `npx` triggers lifecycle scripts, which is by design.
OP is about the fact that manifest contents of the same package version may differ between package contents and registry and looking at the registry is not sufficient to tell which lifecycle scripts will be triggered for a package.
The deeper issue however reflects the same problem regardless of different manifest contents - npm has no control over validation of scripts, or their execution.
The issue I repeated was just one vector of executing these script attacks, the attached PoC shows how easy it is to create a supply chain attack with npm (you focusing on the npx part is the red herring)
Npm have ignored it for years and now it's getting more common.
Comments
Your reported issue is just about the fact that `npx` triggers lifecycle scripts, which is by design.
OP is about the fact that manifest contents of the same package version may differ between package contents and registry and looking at the registry is not sufficient to tell which lifecycle scripts will be triggered for a package.
The deeper issue however reflects the same problem regardless of different manifest contents - npm has no control over validation of scripts, or their execution.
The issue I repeated was just one vector of executing these script attacks, the attached PoC shows how easy it is to create a supply chain attack with npm (you focusing on the npx part is the red herring)
Npm have ignored it for years and now it's getting more common.