Issue 1:
Is there an existing issue for this?

I have searched the existing issues

This is a duplicate of #3306, which was closed by mistake.

This issue exists in the latest npm version

I am using the latest npm

Current Behavior

Let’s say you have a create-blog-post CLI installed globally. You run it like so:

create-blog-post --title 'Cool `ls` tricks'

One day you install create-blog-post locally instead. Then how do you run it? Well, you could just slap npx at the start, right? Wrong! The following does not do what you expect:

npx create-blog-post --title 'Cool `ls` tricks'

Let me show why. I’m using node -p 'process.argv[2]' -- instead of create-blog-post to show that the implementation of that tool wouldn’t matter:

❯ node -p 'process.argv[2]' -- --title 'Cool `ls` tricks'
Cool `ls` tricks

With npx in front:

❯ npx node -p 'process.argv[2]' -- --title 'Cool `ls` tricks'
Cool LICENSE
README.md
lib
map.js
node_modules
package-lock.json
package.json
test tricks

Oops! The argument was treated as shell script, executed ls and put the result in my string (backticks means command interpolation)!

Expected Behavior

npx@6 got it right:

❯ npx --version
6.14.12

❯ npx node -p 'process.argv[2]' -- --title 'Cool `ls` tricks'
Cool `ls` tricks

The worst thing is that I don’t even know how to workaround this issue in npx@8. Trying to add backslashes does not help. I just can’t figure out a way to pass literal backticks as an argument.

Steps To Reproduce

macOS or Linux (Windows have different issues)

With this config...

Run npx node -p 'process.argv[1]' '`' (tested in sh, bash, zsh, fish)

See error: sh: -c: line 0: unexpected EOF while looking for matching ``'

Environment

npm: 8.9.0

Node.js: v18.1.0

OS Name: Linux

npm config:

; node bin location = /usr/local/bin/node
; node version = v18.1.0
; npm local prefix = /
; npm version = 8.9.0
; cwd = /
; HOME = /root
; Run `npm config ls -l` to show all defaults.

❯ docker run --rm -it node:18 bash
root@a78d74c8a6b5:/# npm i -g npm

changed 15 packages, and audited 202 packages in 6s

11 packages are looking for funding
run `npm fund` for details

found 0 vulnerabilities
root@a78d74c8a6b5:/# npm -v
8.9.0
root@a78d74c8a6b5:/# node -v
v18.1.0
root@a78d74c8a6b5:/# uname -a
Linux a78d74c8a6b5 5.10.104-linuxkit #1 SMP Wed Mar 9 19:05:23 UTC 2022 x86_64 GNU/Linux
root@a78d74c8a6b5:/# npm config ls
; node bin location = /usr/local/bin/node
; node version = v18.1.0
; npm local prefix = /
; npm version = 8.9.0
; cwd = /
; HOME = /root
; Run `npm config ls -l` to show all defaults.
root@a78d74c8a6b5:/# npx -v
8.9.0
root@a78d74c8a6b5:/# npx node -p 'process.argv[2]' -- --title 'Cool `ls` tricks'
Cool bin
boot
dev
etc
home
lib
lib64
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var tricks
root@a78d74c8a6b5:/# node -p 'process.argv[2]' -- --title 'Cool `ls` tricks'
Cool `ls` tricks
root@a78d74c8a6b5:/#

Issue 2:
NPM 7.x has problem with instaling module from private git repository and gives me ERR_INVALID_URL error. I'm sure that URL is correct, because with npm 6.x everything works fine.

COMMAND:

npm install --save git+ssh://git@git.my.private.server:somerepository.git

npm ERR! code ERR_INVALID_URL

npm ERR! Invalid URL: git+ssh://git@git.my.private.server:somerepository.git

Environment:

OSX 10.15.4

There is debug log:

0 verbose cli [
0 verbose cli '/usr/local/bin/node',
0 verbose cli '/usr/local/bin/npm',
0 verbose cli 'install',
0 verbose cli '--save',
0 verbose cli 'git+ssh://git@############### '
0 verbose cli ]
1 info using npm@7.0.2
2 info using node@v15.0.0
3 timing config:load:defaults Completed in 1ms
4 timing config:load:file:/usr/local/lib/node_modules/npm/npmrc Completed in 0ms
5 timing config:load:builtin Completed in 1ms
6 timing config:load:cli Completed in 2ms
7 timing config:load:env Completed in 0ms
8 timing config:load:file:/Users/###############/www/_node/###############/.npmrc Completed in 0ms
9 timing config:load:project Completed in 1ms
10 timing config:load:file:/Users/###############/.npmrc Completed in 0ms
11 timing config:load:user Completed in 0ms
12 timing config:load:file:/usr/local/etc/npmrc Completed in 0ms
13 timing config:load:global Completed in 0ms
14 timing config:load:cafile Completed in 1ms
15 timing config:load:validate Completed in 0ms
16 timing config:load:setUserAgent Completed in 0ms
17 timing config:load:setEnvs Completed in 1ms
18 timing config:load Completed in 7ms
19 verbose npm-session 01aeaf9109274f1e
20 timing npm:load Completed in 15ms
21 timing arborist:ctor Completed in 0ms
22 timing arborist:ctor Completed in 1ms
23 timing idealTree:init Completed in 24ms
24 timing idealTree Completed in 3277ms
25 timing command:install Completed in 3281ms
26 verbose stack TypeError [ERR_INVALID_URL]: Invalid URL: git+ssh://git@git.###############
26 verbose stack at new NodeError (node:internal/errors:258:15)
26 verbose stack at onParseError (node:internal/url:258:9)
26 verbose stack at new URL (node:internal/url:334:5)
26 verbose stack at new URL (node:internal/url:331:22)
26 verbose stack at GitFetcher.[_addGitSha] (/usr/local/lib/node_modules/npm/node_modules/pacote/lib/git.js:128:28)
26 verbose stack at /usr/local/lib/node_modules/npm/node_modules/pacote/lib/git.js:228:27
26 verbose stack at processTicksAndRejections (node:internal/process/task_queues:93:5)
26 verbose stack at async Arborist.[retrieveSpecName] (/usr/local/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:410:18)
26 verbose stack at async Promise.all (index 0)
26 verbose stack at async Arborist.[applyUserRequests] (/usr/local/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:368:7)
27 verbose cwd /Users/###############/www/_node/###############
28 verbose Darwin 19.4.0
29 verbose argv "/usr/local/bin/node" "/usr/local/bin/npm" "install" "--save" "git+ssh://git@git.###############"
30 verbose node v15.0.0
31 verbose npm v7.0.2
32 error code ERR_INVALID_URL
33 error Invalid URL: git+ssh://git@###############
34 verbose exit 1