[BUG] existing shell command will mask scoped package with the same name

[dr-js]

What / Why

executing command like npx @dr-js/node will run node directly
but with added tag or version like npx @dr-js/node@dev, the correct package will install and run

also can test with existing command like npx @qwerty/git will just run git

When

when using npx to run a scoped package and:

• have a name same as existing shell command, like: npx @dr-js/node
• do not specify extra version or tag like: npx @dr-js/node@dev

Where

• n/a

How

Current Behavior

• n/a

~# npx @dr-js/node
Welcome to Node.js v12.13.0.
Type ".help" for more information.
> 

Steps to Reproduce

• n/a

Expected Behavior

• n/a

~# npx @dr-js/node
npx: installed 2 in 3.437s
CLI Usage:
  --config --c -c [OPTIONAL] [ARGUMENT=1]
      from ENV: set to "env"
      from JS/JSON file: set to "path/to/config.js|json"
  --help --h -h [OPTIONAL] [ARGUMENT=0+]
      show full help
  --version --v -v [OPTIONAL] [ARGUMENT=0+]
  ...

Who

• n/a

References

• n/a

[ocoka]

its security risk and hard to debug
Raagh/angular-karma_test-explorer#82

[karfau]

zkat/npx#236