"npx mrm@2 lint-staged" creates file named "6" with npm install output

[Macil]

When I run "npx mrm@2 lint-staged" in a repo containing prettier as a dependency (as prettier's docs recommend), it works correctly except that an extra file is created in my repo with the filename "6", and it contains the output of an npm install command. This seems unintended. This is fully reproducible for me.

I'm on Windows and using Powershell, Node v21.6.1, and npm 10.2.4. Here's a terminal log in a fresh directory showing an example of me triggering this in a basic repo containing a dependency on prettier:

PS E:\chris\Coding\lint-staged-test> git init
Initialized empty Git repository in E:/chris/Coding/lint-staged-test/.git/
PS E:\chris\Coding\lint-staged-test> npm init -y
Wrote to E:\chris\Coding\lint-staged-test\package.json:

{
  "name": "lint-staged-test",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC"
}


PS E:\chris\Coding\lint-staged-test> npm install --save-dev --save-exact prettier

added 1 package, and audited 2 packages in 478ms

1 package is looking for funding
  run `npm fund` for details

found 0 vulnerabilities
PS E:\chris\Coding\lint-staged-test> npx mrm@2 lint-staged
Running lint-staged...
Update package.json
Installing lint-staged and husky...
husky - Git hooks installed
husky - created .husky/pre-commit
PS E:\chris\Coding\lint-staged-test> ls


    Directory: E:\chris\Coding\lint-staged-test


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----          4/8/2024  12:56 AM                .husky
d-----          4/8/2024  12:56 AM                node_modules
-a----          4/8/2024  12:56 AM            141 6
-a----          4/8/2024  12:56 AM          25120 package-lock.json
-a----          4/8/2024  12:56 AM            432 package.json


PS E:\chris\Coding\lint-staged-test> cat 6

added 56 packages, and audited 58 packages in 1s

30 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities