Why does `npx <cmd>` work differently than `./node_modules/bin/<cmd>` in the shell?

Question

I discovered that issuing some commands in the terminal's shell via npx worked differently than when invoked through npm scripts, which I found curious, as I believed them to be using the same local executables under the hood (the ones in ./node_modules/.bin). Curiously, stuffing the same commands in a shell script changes the behavior: they now both run exactly alike.

Turns out that if you clone the Sinon repo and install it, these commands work differently (at least on my setup, documented below):

 npx mochify -R dot                 --no-detect-globals --recursive  --grep WebWorker --invert  'test/**/*-test.js'
 ./node_modules/.bin/mochify -R dot --no-detect-globals --recursive  --grep WebWorker --invert  'test/**/*-test.js'

The first outputs (snipped)

  44 passing (12ms)
  2 pending

while the second outputs (snipped)

  1492 passing (740ms)
  13 pending

So 1450 tests are not run in the first case. It turns out it only runs a single test file:

test/issues/issues-test.js

This basically means it matches at a single depth, not any depth: test/*/*-test.js (which has one match).

So "obviously" the shell seems to affect the file matching done with the globbing patterns, but I thought I avoided that issue by enclosing the glob in single quotes. I am missing something that happens in my shell that does not happen when I stuff these commands in a file and run bash test.sh.

npx envinfo --system | egrep -v '(CPU|Memory)'

  System:
    OS: macOS 14.0
    Shell: 5.2.15 - /opt/homebrew/bin/bash