From 8ba4b91ce6b57a1b087d2ec4fb735f5253ec07b5 Mon Sep 17 00:00:00 2001
From: Donovan! <thatgamer253@gmail.com>
Date: Mon, 20 Jul 2026 02:31:54 -0400
Subject: [PATCH] Potential fix for code scanning alert no. 11: Shell command
 built from environment values

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 scripts/release-package-stage.mjs | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/scripts/release-package-stage.mjs b/scripts/release-package-stage.mjs
index 1ed3f58..f1e4728 100644
--- a/scripts/release-package-stage.mjs
+++ b/scripts/release-package-stage.mjs
@@ -46,10 +46,6 @@ function npmPackArgs() {
   return args;
 }
 
-function quoteWindowsArg(value) {
-  return /[\s"]/u.test(value) ? `"${value.replaceAll('"', '\\"')}"` : value;
-}
-
 try {
   mkdirSync(staging, { recursive: true });
   const packageJson = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
@@ -62,12 +58,7 @@ try {
   );
 
   const packArgs = npmPackArgs();
-  const windows = process.platform === 'win32';
-  const command = windows ? (process.env.ComSpec ?? 'cmd.exe') : 'npm';
-  const args = windows
-    ? ['/d', '/s', '/c', `npm.cmd ${packArgs.map(quoteWindowsArg).join(' ')}`]
-    : packArgs;
-  const result = spawnSync(command, args, {
+  const result = spawnSync('npm', packArgs, {
     cwd: staging,
     encoding: 'utf8',
     timeout: 120_000,