[BUG] `npm pack` marks the wrong files as executable

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npm pack will set files as executable if the bin path is a subset of the file path.

Expected Behavior

I expect npm pack to only mark files that are an exact match, or within the directory from directories.bin.

Steps To Reproduce

./package.json:

{
    "name": "bug",
    "version": "1.2.3",
    "bin": "bin/index.js"
}

./bin/index.js:

#!/usr/bin/env node
console.log("./bin/index.js")

./src/bin/index.js:

#!/usr/bin/env node
console.log("./src/bin/index.js")

Both are not executable

$ ls -l bin src/bin
bin:
total 4
-rw-r--r-- 1 dylan staff 49 Aug 30 22:57 index.js

src/bin:
total 4
-rw-r--r-- 1 dylan staff 53 Aug 30 22:57 index.js

Run pack and display the contents of the tarball:

$ npm pack
$ tar -tvf bug-1.2.3.tgz
-rw-r--r--  0 0      0          49 Oct 26  1985 package/bin/index.js
-rwxr-xr-x  0 0      0          53 Oct 26  1985 package/src/bin/index.js
-rw-r--r--  0 0      0          72 Oct 26  1985 package/package.json

The output shows ./src/bin/index.js is marked executable instead of ./bin/index.js

Environment

• npm: 10.8.3
• Node.js: 22.7.0
• OS Name: macos
• System Model Name: macbook pro m1 max
• npm config:

; "user" config from /Users/dylan/.npmrc

//localhost:4873/:_authToken = (protected)
always-auth = false
registry = "http://localhost:4873/"

; node bin location = /opt/homebrew/Cellar/node/22.7.0/bin/node
; node version = v22.7.0
; npm local prefix = /Users/dylan
; npm version = 10.8.3
; cwd = /Users/dylan
; HOME = /Users/dylan
; Run `npm config ls -l` to show all defaults.

Reproduce the behavior with the package.json, bin/index.js, and src/bin/index.js example using npm pack, then inspect the npm pack implementation and its tests to find how bin paths are matched. Done means only the exact bin path, or files under directories.bin, are executable in the generated tarball.