Dashboard › cli › Windows package-manager .cmd spawning

Windows package-manager .cmd spawning

Category: gotcha

Confidence: 1.00

ID: 01a08aa4-45e1-72ee-9b17-b4c451e8d4d0

Project ID: c760f4f9-42b0-4ce0-b36d-6b8c38d770b2

Cross-project: No

Recalled in other projects: 0

Source session: 0rGsfNZYXX3HLfib6

Created: 2026-09-10 09:26:56

Updated: 2026-09-10 09:26:56

Content

Trap: spawning npm, pnpm, or Yarn with shell: false looks safer and matches POSIX behavior, but Windows exposes them as .cmd files and direct spawning fails with ENOENT. Fix: use shell: process.platform === "win32" only with fixed executables and validated arguments; retain direct spawning elsewhere and never pass unsanitized user input.