chores: npm extension: add shell option to execFile in windows env

[frankli0324]

resolves CVE-2024-27980

fixes: #211914

[Septh]

I believe CVE-2024-27980 should be considered here:

    // corepack npm wrapper would automatically update package.json. disable that behavior.
    // COREPACK_ENABLE_AUTO_PIN disables the package.json overwrite, and
    // COREPACK_ENABLE_PROJECT_SPEC makes the npm view command succeed
    //   even if packageManager specified a package manager other than npm.
    const env = { ...process.env, COREPACK_ENABLE_AUTO_PIN: "0", COREPACK_ENABLE_PROJECT_SPEC: "0" }
    const shell = process.platform === 'win32'
    execFile(npmCommandPath, args, { cwd, env, shell }, (error, stdout) => {

[frankli0324]

I believe CVE-2024-27980 should be considered here:

sry for not being familiar with windows but under what circumstances would npm be a cmd/bat script instead of an executable? okay it's distributed as a cmd script...

[meganrogge]

Closing as the linked bug has been fixed