harden(node): strip NODE_OPTIONS + NPM_CONFIG_* for npm/pnpm/npx + JS toolchain

[thehoff]

Goal

Zero-trust layer across the entire Node-based wrappers. NODE_OPTIONS=--require /tmp/evil.js hijacks every Node process — that includes npm, pnpm, npx, vitest, jest, playwright, tsc, eslint, prettier, prisma, next. One env-strip covers the whole ecosystem.

Pattern

secure_node_command(binary) helper used by all Node-spawning sites. Same shape as secure_rg_command().

Env vars to strip

• NODE_OPTIONS (--require, --inspect-brk=0.0.0.0:9229, etc.)
• All NPM_CONFIG_* and npm_config_* (lowercase; matches every .npmrc key including script-shell, ignore-scripts=false, node-options, userconfig, globalconfig)
• PRISMA_QUERY_ENGINE_BINARY, PRISMA_SCHEMA_ENGINE_BINARY, PRISMA_INTROSPECTION_ENGINE_BINARY
• PLAYWRIGHT_BROWSERS_PATH
• TS_NODE_PROJECT
• NEXT_SHARP_PATH

Args to reject

• --require <path> (jest/vitest), --setupFiles, --globalSetup, --reporter <path> (jest/vitest/playwright reporters are arbitrary JS)
• --plugin <abs-path>, --rulesdir, --resolve-plugins-relative-to (eslint), --plugin <abs> (prettier)
• --config <path outside cwd> (every JS tool — soft check)
• npm install/pnpm install/npx <pkg> for packages not in package.json (or just whitelist read verbs)

Wire-in sites

src/cmds/js/*.rs — all 8+ files. Each resolved_command(...) → secure_node_command(...).

Tests

tests/security/node_hardening.rs:

• NODE_OPTIONS="--require /tmp/evil.js" contextcrawler tsc --version does NOT execute evil.js
• NPM_CONFIG_USERCONFIG=/tmp/evil-npmrc contextcrawler npm config get registry does NOT read evil-npmrc
• vitest --reporter /tmp/evil-reporter.js rejected