Invocation / runtime/CLI flag/Explicit

npx / npm exec remote execution

Immediately on invocation, with full process permissions

Lives in: npx, npm exec, npm create / npm init (initializer flows)
Attacker needs: Registry / config control
Lifecycle: Install
Startup
your code
Module load
Runtime
REPL
Runs when someone invokes a command or tool, with full process permissions.

How it runs

npx (and npm exec) fetches a package from the registry, installs it into a throwaway cache, and runs the binary named in its bin field. You never added it to package.json. You might not even have a project yet.

npx create-next-app@latest
npx -y cowsay hello   # -y skips the install confirmation

Those commands pull down the package and its dependencies, then run its CLI with full access to your machine's filesystem, env vars and network. Lifecycle scripts (preinstall, postinstall) still run as part of the install step.

What people actually hit is typosquatting. You fat-finger a name, copy a blog command with a typo, or run npx @scope/some-cli where the scope is one character off. npx resolves whatever string you pass on the public registry. If a squatter owns that name, you just executed their code. You can even run straight from a tarball URL via --package=, which fetches whatever is at that URL right now, with no lockfile guarantees. And npx leaves little trace in the project, which makes audits after the fact hard.

Defend

Verify package names before running; avoid pasting npx one-liners from docs; use a private registry; prefer pinned local devDependencies over ad-hoc npx.