[BUG] `npm pack` marks the wrong files as executable

[dylan-conway]

Is there an existing issue for this?

• [X] I have searched the existing issues

This issue exists in the latest npm version

• [X] I am using the latest npm

Current Behavior

npm pack will set files as executable if the bin path is a subset of the file path.

Expected Behavior

I expect npm pack to only mark files that are an exact match, or within the directory from directories.bin.

Steps To Reproduce

./package.json:

{
    "name": "bug",
    "version": "1.2.3",
    "bin": "bin/index.js"
}

./bin/index.js:

#!/usr/bin/env node
console.log("./bin/index.js")

./src/bin/index.js:

#!/usr/bin/env node
console.log("./src/bin/index.js")

Both are not executable

$ ls -l bin src/bin
bin:
total 4
-rw-r--r-- 1 dylan staff 49 Aug 30 22:57 index.js

src/bin:
total 4
-rw-r--r-- 1 dylan staff 53 Aug 30 22:57 index.js

Run pack and display the contents of the tarball:

$ npm pack
$ tar -tvf bug-1.2.3.tgz
-rw-r--r--  0 0      0          49 Oct 26  1985 package/bin/index.js
-rwxr-xr-x  0 0      0          53 Oct 26  1985 package/src/bin/index.js
-rw-r--r--  0 0      0          72 Oct 26  1985 package/package.json

The output shows ./src/bin/index.js is marked executable instead of ./bin/index.js

Environment

• npm: 10.8.3
• Node.js: 22.7.0
• OS Name: macos
• System Model Name: macbook pro m1 max
• npm config:

; "user" config from /Users/dylan/.npmrc

//localhost:4873/:_authToken = (protected)
always-auth = false
registry = "http://localhost:4873/"

; node bin location = /opt/homebrew/Cellar/node/22.7.0/bin/node
; node version = v22.7.0
; npm local prefix = /Users/dylan
; npm version = 10.8.3
; cwd = /Users/dylan
; HOME = /Users/dylan
; Run `npm config ls -l` to show all defaults.

[kchindam-infy]

Hi @dylan-conway Thanks, could you share the package.json configuration, specifically any bin fields setup? WIll help us to understand how the project is structured and if it has any influence on the installation behavior with .npmrc settings.