v1.41.2 - Security fixes for quoted fix commands and npm alias scanning

Upgrade note. This release contains two security fixes and nothing else.

Security

• Package names read from a lockfile or package.json are now quoted in every copyable command the scanner prints: the npm ls inspection hints, the install commands for phantom dependencies (PD001 and PD002), and chain-resolution and fix-plan commands, in the terminal, the HTML report and JSON. A repository could name a package with shell syntax so that pasting the suggested command ran something else. The quoting is POSIX shell quoting, which covers shells such as bash, zsh and sh; Windows cmd.exe and PowerShell quote differently, so check an unusual package name before pasting a command into either (GHSA-9v96-p5c5-2frh).
• Packages installed through an npm alias in overrides or peerDependencies are now scanned under their real registry name, including nested, versioned and $ references in overrides and lockfile v2 and v3. They were looked up under the alias, so a vulnerable package reported clean and passed --fail-on. A peer alias is only applied when the installed package really is the aliased one, so a peer that npm did not install cannot relabel another package (GHSA-6vp2-w78m-6gf7).

Validation

• npm test
• npm run build

Contributors

• @Nachiket-Roy reported and fixed both issues