At this point the $command also includes the command argument. so escapeshellarg() would wrap the whole thing in quotes `"C:\Program Files\nodejs\node.exe tempfile.js"`

I couldn't really think of a robust way to split the string at the right point to pass it to escapeshellarg(). This regex is pretty foolproof unless there is a ".exe" in some parameter, or your command is something like `echo y | c:\path\app.exe`. (I can imagine a better regex but it's probably overkill).

The regex also doesn't touch unix paths. If you already naturally escaped the unix path like  `/usr/my\ files/bin/node` It would end up as `'/usr/my\ files/bin/node'` which wouldn't work.