[BUG] npm hangs spawning a process because of the spaces included in the process title

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

We are using Laravel with Laravel Mix and for a few months, we have been struggling with upgrading the npm to the latest version because running the "npx mix --production" hangs. It is worth adding that npm is not even starting the mix according to the process list in the system:

root@servername:/# ps -aux | grep mix
www-data   32817  0.0  0.0   2836   736 pts/0    S+   09:45   0:00 sh -c npx mix --production
www-data   32818  101  0.0   3136  2256 pts/0    R+   09:45   1:13 sh -c npx mix --production
root       33158  0.0  0.0   8212   808 pts/1    S+   09:46   0:00 grep --color=auto mix

This is the execution list:

1. npx mix --production
2. sh -c npx mix --production (hangs here)

What is funny enough, we have multiple environments (dev, staging, and a second production) and on the second production with a similar configuration, everything runs smoothly as well as on dev/staging. Both production servers have Ubuntu 20.04 LTS with Node 16.

On other servers the execution looks like this:

1. npx mix --production
2. sh -c npx mix --production
3. npm exec mix --production
4. sh -c mix --production

We use npm clean-install and I have compared node_modules folders (md5sums) - they are exactly the same on both servers.

I was able to track the issue to the specific version of npm that introduced the problem and it was 7.0.11. https://github.com/npm/cli/compare/v7.0.10...v7.0.11

More specifically it seems that setting the process.title to whatever value containing space causes the child process to hang. By editing the npm.js file directly on the server I was able to test different titles. Examples of titles and results:

1. "npm mix --production" hangs
2. "npm mix production" hangs
3. "npm-mix-production" works

As of npm 9.1.1, the issue still persists and is currently located in the lib/npm.js:281:

this.title = ['npm'].concat(replaceInfo(remain)).join(' ').trim()

By changing it to:

this.title = ['npm'].concat(replaceInfo(remain)).join('').trim()

I am able to resolve the issue we have on the server and the child process runs smoothly.

Of course, I am far away from saying that the issue is with the npm setting the title, but I am scratching my head on what could be the issue here as of course we would like to work on the latest npm. My questions/thoughts:

1. Do you know what can cause issues with spawning the child process in this situation?
2. It seems it is not a problem located directly in npm, but in node spawn method https://nodejs.org/api/child_process.html#child_processspawncommand-args-options
3. I can find some GitHub issues in node related to process.title and it seems node internally uses libuv library for handling child processes, however, none of the issues are related to the one we are having
4. There are similar issue related to MacOS and setting process.title to "npm":
   https://github.com/nodejs/node-v0.x-archive/issues/8288
   https://github.com/nodejs/node-v0.x-archive/issues/8279
   However, they are only related. We do not reach max processes on our server, nor do we use MacOS. We also have a high ulimit value in the system.
5. npm config ls is identical on both systems

We have tried node 14/16/18 LTS and the results are the same. Right now I am wondering if we should test it again after upgrading to Ubuntu 22.04 LTS which has a newer libuv library bundled in or maybe switch to using an alternative package manager because I am really unable to find anyone that had or have a similar problem.

Probably the best solution for us would be for npm to stop using spaces in process titles. According to the node documentation:

Certain platforms (macOS, Linux) will use the value of argv[0] for the process title while others (Windows, SunOS) will use command

So, if I understand correctly, the process.title is intended to contain only program name, not the arguments as well. Although removing spaces from titles would be the best solution for us, I am not saying the npm team should do that as I am unable to find any documentation or official guidelines that is saying the spaces are somehow prohibited or can lead to unexpected behavior, but unfortunately in the case of our server - they are. The only additional information on process.title can be found here:

https://nodejs.org/api/process.html#processtitle

When a new value is assigned, different platforms will impose different maximum length restrictions on the title. Usually such restrictions are quite limited. For instance, on Linux and macOS, process.title is limited to the size of the binary name plus the length of the command-line arguments because setting the process.title overwrites the argv memory of the process.

Expected Behavior

Spawning the child process should work smoothly.

Steps To Reproduce

Unfortunately, this is related to only one environment and I am unable to provide the exact steps to reproduce the issue as I am unable to locate the exact cause.

Environment

• npm: 7.0.11 - 9.1.1
• Node.js: 14/16/18
• OS Name: Ubuntu 20.04 LTS
• Kernel: 5.4.0-131-generic

Start by comparing lib/npm.js around line 281 with the npm 7.0.10 to 7.0.11 changes, focusing on process.title and child-process spawning. Reproduce the reported behavior on Ubuntu 20.04 with the listed Node and npm versions using titles with and without spaces; done means the child process spawns successfully or the cause is narrowed to a documented platform dependency.