[BUG] Modules run via npx interpret strings that look like environment variables

[YodaDaCoda]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

npm exec is interpreting argv strings that look like environment variables. Passing, for example, test$param results in test being passed to the module (because param is not defined in the environment).

Expected Behavior

Strings passed should not be interpreted.

Steps To Reproduce

1. Issue occurs with this environment:
   npm >=v7.1.0.
   Earlier versions are unaffected.
   Installed node version doesn't appear to matter (tested with various v14/v15/v16 releases)

2. With this config
   a file in node_modules/.bin/testington with this content:

#!/usr/bin/env node
console.log(process.argv[2]);

3. Run '...'

Note proper quotes used to avoid bash interpreting the string.

$ npm exec testington 'test$param'
test

$ export param=asdf
$ npm exec testington 'test$param'
testasdf

4. See error...

Note that npx intereprets environment variables within the string before they reach the module.

Environment

• OS: Ubuntu 20.04
• Node: v16.6.0
• npm: 7.1.0

[ljharb]

Are you sure that’s not your shell doing it?

[YodaDaCoda]

Positive. This snippet from my console demonstrates the behaviour change. I'm using volta for convenience bisecting, but I am able to replicate this on systems without volta.

$ volta install [email protected]
success: installed and set [email protected] as default
$ npx --version
7.1.0
$ npx testington 'test$param'
test
$ volta install [email protected]
success: installed and set [email protected] as default
$ npx --version
7.0.15
$ npx testington 'test$param'
test$param

EDIT: or, if it is the shell interpreting it, it's because npm/npx is passing around the params in an unsafe way.

[egorkel-da14]

I have similar problem with setting firebase functions config.
When I execute npx firebase functions:config:set settings.var='abc$123' then settings.var='abc'
If I use firebase functions:config:set settings.var='abc$123' (without npx) then settings.var='abc$123'
My npx version 7.20.3