[tufstraka]

When npx runs a package on Windows, the bin name from package.json ends up in a cmd.exe command. Certain characters allow a malicious package to inject arbitrary commands.

Example: a package published with "bin": {"evil&calc": "./index.js"} will run calc.exe on a victim's machine when they npx it — cmd.exe treats & as a command separator.

This patch escapes cmd.exe metacharacters (&, |, <, >, ^, (, ), @, !, ", \t) with ^. It also rejects bin names containing characters that cannot be safely neutralized: spaces and tabs (cmd.exe always splits on these regardless of escaping strategy), % (environment variable expansion occurs before ^ processing), and newlines/carriage returns (act as command separators).

+      if (/[%\r\n ]/.test(args[0])) {
+        throw new Error(
+          `Cannot execute bin name containing unsafe characters on Windows: ${args[0]}`
+        )
+      }
+      args[0] = args[0].replace(/([&|<>^()@!"\t])/g, '^$1')

Verified on real Windows via GitHub Actions — cmd.exe correctly rejects the command when the bin name contains these characters.

[martinrrm]

Thanks for reporting this issue, this is a true bug but we should fix this in promise-spawn package first and then a follow up PR in the cli, I have created a PR for this npm/promise-spawn#166