They are indeed the scripts as defined in the package.json file as you discovered. The values are run by your shell (so, for example, bash, zsh, etc. on UNIX-like operating systems).
One key thing to note is that the node_modules/.bin directory is added to PATH before executing. So, in the case of the two scripts you’re asking about, cross-env can be found in node_modules/.bin (because it’s almost certainly specified as a devDependency elsewhere in the package.json) as long as you’ve already run npm install or npm ci within the project directory.