fix: sanitize env before spawning npm subprocess

npm · Sep 1, 2021 · d8ac68c · d8ac68c
1 parent 33d6891
commit d8ac68c
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/lib/install.js b/lib/install.js
@@ -15,7 +15,15 @@ const devDeps = [
 ]
 
 const npm = (root, args) => {
+  const env = {}
+  for (const [key, value] of Object.entries(process.env)) {
+    if (!key.startsWith('npm_')) {
+      env[key] = value
+    }
+  }
+
   return spawn('npm', args, {
+    env,
     cwd: root,
     stdioString: true,
   })