[BUG] `npm pack` marks the wrong files as executable

Is there an existing issue for this?

[X] I have searched the existing issues

This issue exists in the latest npm version

[X] I am using the latest npm

Current Behavior

npm pack will set files as executable if the bin path is a subset of the file path.

Expected Behavior

I expect npm pack to only mark files that are an exact match, or within the directory from directories.bin.

Steps To Reproduce

./package.json:

{
    "name": "bug",
    "version": "1.2.3",
    "bin": "bin/index.js"
}

./bin/index.js:

#!/usr/bin/env node
console.log("./bin/index.js")

./src/bin/index.js:

#!/usr/bin/env node
console.log("./src/bin/index.js")

Both are not executable

$ ls -l bin src/bin
bin:
total 4
-rw-r--r-- 1 dylan staff 49 Aug 30 22:57 index.js

src/bin:
total 4
-rw-r--r-- 1 dylan staff 53 Aug 30 22:57 index.js

Run pack and display the contents of the tarball:

$ npm pack
$ tar -tvf bug-1.2.3.tgz
-rw-r--r--  0 0      0          49 Oct 26  1985 package/bin/index.js
-rwxr-xr-x  0 0      0          53 Oct 26  1985 package/src/bin/index.js
-rw-r--r--  0 0      0          72 Oct 26  1985 package/package.json

The output shows ./src/bin/index.js is marked executable instead of ./bin/index.js

Environment

npm: 10.8.3
Node.js: 22.7.0
OS Name: macos
System Model Name: macbook pro m1 max

npm config:


; "user" config from /Users/dylan/.npmrc

//localhost:4873/:_authToken = (protected) always-auth = false registry = "http://localhost:4873/"

; node bin location = /opt/homebrew/Cellar/node/22.7.0/bin/node ; node version = v22.7.0 ; npm local prefix = /Users/dylan ; npm version = 10.8.3 ; cwd = /Users/dylan ; HOME = /Users/dylan ; Run npm config ls -l to show all defaults.

npm / cli