W-23795493-resolve npm from PATH only, not CWD

[soridalac]

Summary

• Reject any npm binary resolved from the current working directory
• On Windows, both execFile (via CreateProcess) and the which module resolve executables from CWD before PATH, bypassing the previous exec → execFile fix
• Use which to resolve npm, then verify the resolved path is not inside CWD before executing
• When resolved path is a .cmd/.bat file, pass { shell: true } with the absolute path so Windows can execute it

Test plan

• Windows VM: npm.exe (copy of calc.exe) in CWD → calc no longer opens
• Windows VM: normal directory → sf version --verbose works with publish dates
• macOS: linked plugin → sf version --verbose works normally
• Unit tests pass

@W-23795493@

[WillieRuemmele]

QA Notes

---

✅ : verified

plugin-version.mov