[sarthak-19]

Summary

npx downloads a package (and its dependencies) from the registry and runs their install scripts when the package isn't found locally. Each such call in build/test tooling is a point where a compromised package could run code during a build. This replaces each npx call with npm exec --no --, which only runs an already-installed local binary and fails instead of installing when the package is missing.

This mirrors the fix already applied in WordPress/wordpress-develop#13021 for the same class of issue.

Fixes #2654

Changes

• .husky/pre-commit: npx lint-staged → npm exec --no -- lint-staged
• .wp-env.test.json: npx wp-env ... → npm exec --no -- wp-env ...
• .github/workflows/e2e-test.yml: npx playwright install chromium --with-deps → npm exec --no -- playwright install chromium --with-deps

All three packages (lint-staged, @wordpress/env, @playwright/test) are already devDependencies in package.json, so this is behavior-neutral.

Test plan

• Searched the repo for all remaining npx usages outside node_modules/package-lock.json — none found.
• Verified npm exec --no -- lint-staged resolves the local binary successfully.
• Confirmed the pre-commit hook runs correctly with the updated command (observed during this PR's own commit).
• CI: confirm the e2e-test.yml workflow still installs Playwright and runs e2e tests successfully.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @sarthak.jaiswal@rtCamp.com.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: sarthak.jaiswal@rtCamp.com.

Co-authored-by: westonruter <westonruter@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.