[BUG] `min-release-age-exclude` is not honored by `npx`

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

When min-release-age is configured alongside min-release-age-exclude in a .npmrc, packages whose name matches an exclude glob should be exempt from the release-age cutoff.
However, npx still enforces the cutoff for packages that match the exclude pattern, rejecting them with ETARGET

Expected Behavior

npx should exclude packages from the min-release-age if the package follows the min-release-age-exclude in the .npmrc

Steps To Reproduce

1. In this environment:

• npm: 12.0.1
• Node: v26.5.0
• OS: Linux

2. With this config in ~/.npmrc:
   min-release-age=3
   min-release-age-exclude=@myscope/*

3. Run:
   npx @myscope/some-package@1.2.3

4. See error:
   npm error code ETARGET
   npm error notarget No matching version found for @myscope/some-package@1.2.3 with a date before .
   npm error notarget In most cases you or one of your dependencies are requesting a package version that doesn't exist.

5. Workaround:
   Explicitly passing --min-release-age=0 on the CLI does bypass the restriction:
   npx --min-release-age=0 @myscope/some-package@1.2.3

Environment

• npm: 12.0.1
• Node.js: v26.5.0
• OS Name: Linux
• npm config:

ignore-scripts = true
min-release-age = 3
min-release-age-exclude = ["@myscope/*"]

; node version = v26.5.0
; npm version = 12.0.1

Start by reproducing the failure through the npx entry point with the shown .npmrc values and scoped package command. Trace how min-release-age and min-release-age-exclude are read and applied, then verify that a matching package bypasses the cutoff while a nonmatching package still enforces it; add or update regression coverage if the repository provides it.