From 5450125e05be0d9a126f52ff133ed78832f9f43e Mon Sep 17 00:00:00 2001
From: Willie Ruemmele <willieruemmele@gmail.com>
Date: Thu, 13 Aug 2026 10:43:41 -0600
Subject: [PATCH] fix: pass cwd to npmRunPathEnv to prevent PATH hijack
 @W-23797722@

---
 src/spawn.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/spawn.ts b/src/spawn.ts
index 51141697..3af5b88a 100644
--- a/src/spawn.ts
+++ b/src/spawn.ts
@@ -30,7 +30,7 @@ export async function spawn(modulePath: string, args: string[] = [], {cwd, logLe
     const spawned = cpSpawn(modulePath, args, {
       cwd,
       env: {
-        ...npmRunPathEnv(),
+        ...npmRunPathEnv({cwd}),
         // Disable husky hooks because a plugin might be trying to install them, which will
         // break the install since the install location isn't a .git directory.
         HUSKY: '0',