10ffa9f35 · fix(libnpmexec): escape inferred executable names for selected shell (#10044)
libnpmexec
The npm exec (npx) Programmatic API
Install
npm install libnpmexec
Usage:
const libexec = require('libnpmexec')
await libexec({
args: ['yosay', 'Bom dia!'],
cache: '~/.npm/_cacache',
npxCache: '~/.npm/_npx',
yes: true,
})API:
libexec(opts)
-
opts:args: List of pkgs to execute Array, defaults to []call: An alternative shell script to run when usingpackagesoption String, defaults to empty string. Unlike an executable selected fromargsor a package’sbin, this is intentionally interpreted as shell syntax.cache: The path location to where the npm cache folder is placed StringnpxCache: The path location to where the npx cache folder is placed Stringchalk: Chalk instance to use for colors? RequiredlocalBin: Location to thenode_modules/.binfolder of the local project to start scanning for bin files String, defaults to./node_modules/.bin. libexec will walk up the directory structure looking fornode_modules/.binfolders in parent folders that might satisfy the currentargand will use that bin if found.locationMsg: Overrides “at location” message when entering interactive mode StringglobalBin: Location to the global space bin folder, same as:$(npm bin -g)String, defaults to empty string.packages: A list of packages to be used (possibly fetch from the registry) Array, defaults to []path: Location to where to read local project info (package.json) String, defaults to.runPath: Location to where to execute the script String, defaults to.scriptShell: Default shell to be used String, defaults toshon POSIX systems,process.env.ComSpecORcmdon Windowsyes: Should skip download confirmation prompt when fetching missing packages from the registry? Booleanregistry,cache, and more options that are forwarded to @npmcli/arboristgithub and pacotegithub Object
Executable names are escaped for the selected shell, including POSIX shells and PowerShell used on Windows. For inferred PowerShell invocations, arguments are also escaped as literal strings. With
cmd.exe, executable names containing double quotes, percent signs, exclamation marks, or control characters are rejected withEINVALIDCOMMAND. Use a bin name without these characters. On a matching npx-cache hit, command selection uses the installed package’sbinrather than the registry’s bin metadata.