If you can find the DEX version of NPXS10031 application, you just have to replace its content in "vs0:/app" using VitaRW (do not touch something else, especially os0 partition!). There is no need to change "shell.self".
Once it is done, you should add a custom bubble by editing "app.db".
See the following link (in French):
http://www.customprotocol.com/underground/package-installer-1-0-revient-3-60/
However, the DEX version has some limitations when the PKG needs some DRM. To avoid those limitations, the only way is to keep CEX version and it could be started using IDU mode (but you should definitly stay away from this mode, mistakes could be done really easily).
The last solution which could probably avoid the DRM issue would, maybe, be the decrypted and patched CEX version but I do not find the link because it was done by MajorTom who delete all his Vita stuff on the web, here is a trace of the usage:
https://www.reddit.com/r/vitahacks/...or_tom_see_readmetxt/?st=jct2jwf8&sh=6fb77f5e
By curiosity, with tools like NPS Browser and LIve Area refresh (from VitaShell), is there any advantage of being able to install PKG files on the PS Vita?