From 75f2de89a407c4a7f17fc636c26a6c28fc3da7e1 Mon Sep 17 00:00:00 2001
From: Lazizbek Ergashev <lazerg2@gmail.com>
Date: Tue, 18 Aug 2026 23:14:58 +0500
Subject: [PATCH 1/2] fix(exec): don't inherit global config when installing to
 the npx cache

---
 workspaces/libnpmexec/lib/index.js     |  1 +
 workspaces/libnpmexec/test/registry.js | 30 ++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/workspaces/libnpmexec/lib/index.js b/workspaces/libnpmexec/lib/index.js
index 4d7c126654689..2e2679877ea82 100644
--- a/workspaces/libnpmexec/lib/index.js
+++ b/workspaces/libnpmexec/lib/index.js
@@ -264,6 +264,7 @@ const exec = async (opts) => {
     const npxArb = new Arborist({
       ...flatOptions,
       path: installDir,
+      global: false,
     })
     const lockPath = join(installDir, 'concurrency.lock')
     const npxTree = await withLock(lockPath, () => npxArb.loadActual())
diff --git a/workspaces/libnpmexec/test/registry.js b/workspaces/libnpmexec/test/registry.js
index adbf4116107b4..47877a4bd7765 100644
--- a/workspaces/libnpmexec/test/registry.js
+++ b/workspaces/libnpmexec/test/registry.js
@@ -328,3 +328,33 @@ t.test('override save to true when installing to npx cache', async t => {
     value: 'packages-2.0.0',
   })
 })
+
+t.test('ignore inherited global config when installing to npx cache', async t => {
+  const { fixtures, package } = createPkg({ versions: ['2.0.0'] })
+
+  const hash = crypto.createHash('sha512')
+    .update('@npmcli/create-index')
+    .digest('hex')
+    .slice(0, 16)
+
+  const { exec, path, registry, readOutput } = setup(t, {
+    testdir: merge(fixtures, {
+      global: {},
+    }),
+  })
+
+  await package({ registry, path })
+
+  await exec({
+    args: ['@npmcli/create-index'],
+    globalPath: resolve(path, 'global'),
+    global: true,
+  })
+
+  const binPath = resolve(path, 'npxCache', hash, 'node_modules', '.bin')
+  t.ok(existsSync(binPath), 'bins should be linked inside the npx cache entry')
+
+  t.match(await readOutput('@npmcli-create-index'), {
+    value: 'packages-2.0.0',
+  })
+})

From 56a2bf8139fa90bfc19bfa485fe4c82fbfa0b3ae Mon Sep 17 00:00:00 2001
From: Lazizbek Ergashev <lazerg2@gmail.com>
Date: Tue, 18 Aug 2026 23:26:35 +0500
Subject: [PATCH 2/2] chore(exec): assert npx cache bins are not linked
 globally

---
 workspaces/libnpmexec/test/registry.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/workspaces/libnpmexec/test/registry.js b/workspaces/libnpmexec/test/registry.js
index 47877a4bd7765..d1c2489b6f3d8 100644
--- a/workspaces/libnpmexec/test/registry.js
+++ b/workspaces/libnpmexec/test/registry.js
@@ -352,7 +352,8 @@ t.test('ignore inherited global config when installing to npx cache', async t =>
   })
 
   const binPath = resolve(path, 'npxCache', hash, 'node_modules', '.bin')
-  t.ok(existsSync(binPath), 'bins should be linked inside the npx cache entry')
+  t.ok(existsSync(binPath), 'bins should be linked at npxCache')
+  t.notOk(existsSync(resolve(path, 'npxCache', 'bin')), 'bins should not be linked globally')
 
   t.match(await readOutput('@npmcli-create-index'), {
     value: 'packages-2.0.0',