Modules run via npx issue with piped strings

[YodaDaCoda]

Version

v15.5.0

Platform

Linux max 5.4.0-77-generic #86-Ubuntu SMP Thu Jun 17 02:35:03 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

Subsystem

No response

What steps will reproduce the bug?

Create a file node_modules/.bin/testington with the following content:

#!/usr/bin/env node
console.log(process.argv[2]);

Execute it like the following:

echo 'test$param' | xargs -I'{}' npx testington '{}'

Note that it prints out test rather than test$param.

If you execute it like the following (i.e. setting the $param environment variable):

export param=asdf
echo 'test$param' | xargs -I'{}' npx testington '{}'

Note that it prints out testasdf.

How often does it reproduce? Is there a required condition?

Only occurs when run via npx, not when executed via node.

What is the expected behavior?

Environment variables should not be interpreted in piped strings.

What do you see instead?

Environment variables are interpreted, even though the piped strings are quoted appropriately.

Additional information

I've bisected this issue and it first appears in node v15.5.0. v15.4.0 and earlier are unaffected. Current v16.6.0 is still affected.

[YodaDaCoda]

I didn't realise npx is part of npm/cli - will move this report to the appropriate repo.