NPM themselves recently launched a new package called npx [0] which will download and execute packages directly from the registry if you don't already have them installed. So if you make a simple typo like this:

    npx crossenv foo

instead of

    npx cross-env foo

you'd have got the malicious version.

[0] https://www.npmjs.com/package/npx