The deeper issue however reflects the same problem regardless of different manifest contents - npm has no control over validation of scripts, or their execution

The deeper issue however reflects the same problem regardless of different manifest contents - npm has no control over validation of scripts, or their execution. The issue I repeated was just one vector of executing these script attacks, the attached PoC shows how easy it is to create a supply chain attack with npm (you focusing on the npx part is the red herring) Npm have ignored it for years and now it's getting more common.