fix: sub processes with spaces work

Signed-off-by: Jan Kowalleck <[email protected]>

Author: jkowalleck

src/builders.ts

@@ -113,7 +113,7 @@ export class BomBuilder {
     )
   }
 
-  private getNpmCommand (process: NodeJS.Process): string {
+  private getNpmCommand (process: NodeJS.Process): string | 'npm' {
     // `npm_execpath` will be whichever cli script has called this application by npm.
     // This can be `npm`, `npx`, or `undefined` if called by `node` directly.
     const execPath = process.env.npm_execpath ?? ''
@@ -160,8 +160,7 @@ export class BomBuilder {
     this.console.info('INFO  | gather dependency tree ...')
     this.console.debug('DEBUG | npm-ls: run %s with %j in %s', command, args, projectDir)
     const npmLsReturns = spawnSync(command, args, {
-      // must use a shell for Windows systems in order to work
-      shell: true,
+      shell: command === 'npm',
       cwd: projectDir,
       env: process.env,
       encoding: 'buffer',