`which` bin conflicts with native `which` when running npm scripts...

[busticated]

hey there :wave:

thanks for a very helpful lib :pray::+1:

i'm coming here by way of execa having hit upon a fairly gnarly edge-case:

let's say you have a js script that tries to execute a file via execa and the file it executes runs which. if you run that script via npm - e.g. npm run my-script.js - cross-spawn's which dependency overrides the native one and can produce different / unexpected results.

this is due to the which dependency (source) installing a which bin into node_modules/.bin (source) combined with the behavior of npm run:

In addition to the shell’s pre-existing PATH, npm run adds node_modules/.bin to the PATH provided to scripts

(source)

in my case, i was trying to run a script file on windows using cygwin. within powershell, running:

bash -c "which make"

gave me:

/usr/bin/make

but doing the same using a node script run via npm run:

const { stdout } = await execa('bash -c "which make");

gave me:

C:\cygwin\bin\make.EXE

the later uses a windows-style path b/c it relies on node's view of the environment (vs. cygwin' bash's view).

it gets worse when you try to look for an executable script that is not an .exe - e.g. bash -c "which libtool". in this case, the node / npm version of which returns nothing while the native version correctly locates the script in /usr/bin/libtool

my work-around at the moment is to simply not use npm run to execute my script. naively, i wonder if there's a way to avoid having the which dependency install a bin (since it looks like cross-spawn only ever uses the dependency via require('which').

🤷‍♂

[radar]

Should this perhaps be filed on https://github.com/npm/node-which instead?