fix(osv_check): honor npx --package/-p install target when parsing package arg (#40567)

Salvaged from #40461; cleaned up, re-verified against main, tests added.

Co-authored-by: HeLLGURD <HeLLGURD@users.noreply.github.com>

tools/osv_check.py

@@ -82,11 +82,25 @@ def _parse_package_from_args(
     if not args:
         return None, None
 
-    # Skip flags to find the package token
+    # Skip flags to find the package token.
+    # Honor npx's explicit install target: --package=NAME / --package NAME and
+    # the -p NAME short form, which name a package distinct from the executed
+    # binary. Without this the first bare positional (often the command name)
+    # is mistaken for the package.
     package_token = None
+    take_next = False
     for arg in args:
         if not isinstance(arg, str):
             continue
+        if take_next:
+            package_token = arg
+            break
+        if arg in ("--package", "-p"):
+            take_next = True
+            continue
+        if arg.startswith("--package="):
+            package_token = arg[len("--package="):]
+            break
         if arg.startswith("-"):
             continue
         package_token = arg