diff --git a/node_modules/@npmcli/run-script/lib/escape.js b/node_modules/@npmcli/run-script/lib/escape.js
new file mode 100644
index 0000000000000..29d24a8bc4065
--- /dev/null
+++ b/node_modules/@npmcli/run-script/lib/escape.js
@@ -0,0 +1,67 @@
+'use strict'
+
+// eslint-disable-next-line max-len
+// this code adapted from: https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/
+const cmd = (input) => {
+  if (!input.length) {
+    return '""'
+  }
+
+  let result
+  if (!/[ \t\n\v"]/.test(input)) {
+    result = input
+  } else {
+    result = '"'
+    for (let i = 0; i <= input.length; ++i) {
+      let slashCount = 0
+      while (input[i] === '\\') {
+        ++i
+        ++slashCount
+      }
+
+      if (i === input.length) {
+        result += '\\'.repeat(slashCount * 2)
+        break
+      }
+
+      if (input[i] === '"') {
+        result += '\\'.repeat(slashCount * 2 + 1)
+        result += input[i]
+      } else {
+        result += '\\'.repeat(slashCount)
+        result += input[i]
+      }
+    }
+    result += '"'
+  }
+
+  // and finally, prefix shell meta chars with a ^
+  result = result.replace(/[!^&()<>|"]/g, '^$&')
+  // except for % which is escaped with another %
+  result = result.replace(/%/g, '%%')
+
+  return result
+}
+
+const sh = (input) => {
+  if (!input.length) {
+    return `''`
+  }
+
+  if (!/[\t\n\r "#$&'()*;<>?\\`|~]/.test(input)) {
+    return input
+  }
+
+  // replace single quotes with '\'' and wrap the whole result in a fresh set of quotes
+  const result = `'${input.replace(/'/g, `'\\''`)}'`
+    // if the input string already had single quotes around it, clean those up
+    .replace(/^(?:'')+(?!$)/, '')
+    .replace(/\\'''/g, `\\'`)
+
+  return result
+}
+
+module.exports = {
+  cmd,
+  sh,
+}
diff --git a/node_modules/@npmcli/run-script/lib/make-spawn-args.js b/node_modules/@npmcli/run-script/lib/make-spawn-args.js
index 9cfc84b0e0de1..6f3aa4c00a14c 100644
--- a/node_modules/@npmcli/run-script/lib/make-spawn-args.js
+++ b/node_modules/@npmcli/run-script/lib/make-spawn-args.js
@@ -1,8 +1,12 @@
 /* eslint camelcase: "off" */
 const isWindows = require('./is-windows.js')
 const setPATH = require('./set-path.js')
+const { chmodSync: chmod, unlinkSync: unlink, writeFileSync: writeFile } = require('fs')
+const { tmpdir } = require('os')
 const { resolve } = require('path')
+const which = require('which')
 const npm_config_node_gyp = require.resolve('node-gyp/bin/node-gyp.js')
+const escape = require('./escape.js')
 
 const makeSpawnArgs = options => {
   const {
@@ -12,11 +16,28 @@ const makeSpawnArgs = options => {
     env = {},
     stdio,
     cmd,
+    args = [],
     stdioString = false,
   } = options
 
+  let scriptFile
+  let script = ''
   const isCmd = /(?:^|\\)cmd(?:\.exe)?$/i.test(scriptShell)
-  const args = isCmd ? ['/d', '/s', '/c', cmd] : ['-c', cmd]
+  if (isCmd) {
+    scriptFile = resolve(tmpdir(), `${event}-${Date.now()}.cmd`)
+    script += '@echo off\n'
+    script += `${cmd} ${args.map((arg) => escape.cmd(arg)).join(' ')}`
+  } else {
+    const shellPath = which.sync(scriptShell)
+    scriptFile = resolve(tmpdir(), `${event}-${Date.now()}.sh`)
+    script += `#!${shellPath}\n`
+    script += `${cmd} ${args.map((arg) => escape.sh(arg)).join(' ')}`
+  }
+  writeFile(scriptFile, script)
+  if (!isCmd) {
+    chmod(scriptFile, '0775')
+  }
+  const spawnArgs = isCmd ? ['/d', '/s', '/c', scriptFile] : ['-c', scriptFile]
 
   const spawnOpts = {
     env: setPATH(path, {
@@ -34,7 +55,14 @@ const makeSpawnArgs = options => {
     ...(isCmd ? { windowsVerbatimArguments: true } : {}),
   }
 
-  return [scriptShell, args, spawnOpts]
+  const cleanup = () => {
+    // delete the script, this is just a best effort
+    try {
+      unlink(scriptFile)
+    } catch (err) {}
+  }
+
+  return [scriptShell, spawnArgs, spawnOpts, cleanup]
 }
 
 module.exports = makeSpawnArgs
diff --git a/node_modules/@npmcli/run-script/lib/run-script-pkg.js b/node_modules/@npmcli/run-script/lib/run-script-pkg.js
index a6fa4d2b38948..84c5e2bfe0c52 100644
--- a/node_modules/@npmcli/run-script/lib/run-script-pkg.js
+++ b/node_modules/@npmcli/run-script/lib/run-script-pkg.js
@@ -31,7 +31,7 @@ const runScriptPkg = async options => {
   if (options.cmd) {
     cmd = options.cmd
   } else if (pkg.scripts && pkg.scripts[event]) {
-    cmd = pkg.scripts[event] + args.map(a => ` ${JSON.stringify(a)}`).join('')
+    cmd = pkg.scripts[event]
   } else if (
     // If there is no preinstall or install script, default to rebuilding node-gyp packages.
     event === 'install' &&
@@ -42,7 +42,7 @@ const runScriptPkg = async options => {
   ) {
     cmd = defaultGypInstallScript
   } else if (event === 'start' && await isServerPackage(path)) {
-    cmd = 'node server.js' + args.map(a => ` ${JSON.stringify(a)}`).join('')
+    cmd = 'node server.js'
   }
 
   if (!cmd) {
@@ -54,15 +54,18 @@ const runScriptPkg = async options => {
     console.log(bruce(pkg._id, event, cmd))
   }
 
-  const p = promiseSpawn(...makeSpawnArgs({
+  const [spawnShell, spawnArgs, spawnOpts, cleanup] = makeSpawnArgs({
     event,
     path,
     scriptShell,
     env: packageEnvs(env, pkg),
     stdio,
     cmd,
+    args,
     stdioString,
-  }), {
+  })
+
+  const p = promiseSpawn(spawnShell, spawnArgs, spawnOpts, {
     event,
     script: cmd,
     pkgid: pkg._id,
@@ -88,7 +91,7 @@ const runScriptPkg = async options => {
     } else {
       throw er
     }
-  })
+  }).finally(cleanup)
 }
 
 module.exports = runScriptPkg
diff --git a/node_modules/@npmcli/run-script/package.json b/node_modules/@npmcli/run-script/package.json
index 733b27e44a1b8..38c4862e1db2f 100644
--- a/node_modules/@npmcli/run-script/package.json
+++ b/node_modules/@npmcli/run-script/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/run-script",
-  "version": "3.0.2",
+  "version": "4.1.0",
   "description": "Run a lifecycle script for a package (descendant of npm-lifecycle)",
   "author": "GitHub Inc.",
   "license": "ISC",
@@ -23,7 +23,7 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.0.1",
-    "@npmcli/template-oss": "3.2.2",
+    "@npmcli/template-oss": "3.5.0",
     "minipass": "^3.1.6",
     "require-inject": "^1.4.4",
     "tap": "^16.0.1"
@@ -48,6 +48,6 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "3.2.2"
+    "version": "3.5.0"
   }
 }
diff --git a/node_modules/pacote/package.json b/node_modules/pacote/package.json
index af100fa8d6bfa..696c925d35320 100644
--- a/node_modules/pacote/package.json
+++ b/node_modules/pacote/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "13.6.0",
+  "version": "13.6.1",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {
@@ -45,7 +45,7 @@
     "@npmcli/git": "^3.0.0",
     "@npmcli/installed-package-contents": "^1.0.7",
     "@npmcli/promise-spawn": "^3.0.0",
-    "@npmcli/run-script": "^3.0.1",
+    "@npmcli/run-script": "^4.1.0",
     "cacache": "^16.0.0",
     "chownr": "^2.0.0",
     "fs-minipass": "^2.1.0",
diff --git a/package-lock.json b/package-lock.json
index 2880a4c70e1ca..e6302e3431143 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -93,7 +93,7 @@
         "@npmcli/fs": "^2.1.0",
         "@npmcli/map-workspaces": "^2.0.3",
         "@npmcli/package-json": "^2.0.0",
-        "@npmcli/run-script": "^3.0.1",
+        "@npmcli/run-script": "^4.1.0",
         "abbrev": "~1.1.1",
         "archy": "~1.0.0",
         "cacache": "^16.1.1",
@@ -138,7 +138,7 @@
         "npm-user-validate": "^1.0.1",
         "npmlog": "^6.0.2",
         "opener": "^1.5.2",
-        "pacote": "^13.6.0",
+        "pacote": "^13.6.1",
         "parse-conflict-json": "^2.0.2",
         "proc-log": "^2.0.1",
         "qrcode-terminal": "^0.12.0",
@@ -1042,9 +1042,9 @@
       }
     },
     "node_modules/@npmcli/run-script": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@npmcli/run-script/-/run-script-3.0.2.tgz",
-      "integrity": "sha512-vdjD/PMBl+OX9j9C9irx5sCCIKfp2PWkpPNH9zxvlJAfSZ3Qp5aU412v+O3PFJl3R1PFNwuyChCqHg4ma6ci2Q==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/run-script/-/run-script-4.1.0.tgz",
+      "integrity": "sha512-bVX9/2YhQscdlC5WEDQ8HH7bw32klCiAvOSvUHJcmeUTUuaQ7z42KiwmnkXWqhVKKhbWPBp+5H0kN6WDyfknzw==",
       "inBundle": true,
       "dependencies": {
         "@npmcli/node-gyp": "^2.0.0",
@@ -5553,15 +5553,15 @@
       }
     },
     "node_modules/pacote": {
-      "version": "13.6.0",
-      "resolved": "https://registry.npmjs.org/pacote/-/pacote-13.6.0.tgz",
-      "integrity": "sha512-zHmuCwG4+QKnj47LFlW3LmArwKoglx2k5xtADiMCivVWPgNRP5QyLDGOIjGjwOe61lhl1rO63m/VxT16pEHLWg==",
+      "version": "13.6.1",
+      "resolved": "https://registry.npmjs.org/pacote/-/pacote-13.6.1.tgz",
+      "integrity": "sha512-L+2BI1ougAPsFjXRyBhcKmfT016NscRFLv6Pz5EiNf1CCFJFU0pSKKQwsZTyAQB+sTuUL4TyFyp6J1Ork3dOqw==",
       "inBundle": true,
       "dependencies": {
         "@npmcli/git": "^3.0.0",
         "@npmcli/installed-package-contents": "^1.0.7",
         "@npmcli/promise-spawn": "^3.0.0",
-        "@npmcli/run-script": "^3.0.1",
+        "@npmcli/run-script": "^4.1.0",
         "cacache": "^16.0.0",
         "chownr": "^2.0.0",
         "fs-minipass": "^2.1.0",
@@ -10004,7 +10004,7 @@
         "@npmcli/name-from-folder": "^1.0.1",
         "@npmcli/node-gyp": "^2.0.0",
         "@npmcli/package-json": "^2.0.0",
-        "@npmcli/run-script": "^3.0.0",
+        "@npmcli/run-script": "^4.1.0",
         "bin-links": "^3.0.0",
         "cacache": "^16.0.6",
         "common-ancestor-path": "^1.0.1",
@@ -10018,7 +10018,7 @@
         "npm-pick-manifest": "^7.0.0",
         "npm-registry-fetch": "^13.0.0",
         "npmlog": "^6.0.2",
-        "pacote": "^13.0.5",
+        "pacote": "^13.6.1",
         "parse-conflict-json": "^2.0.1",
         "proc-log": "^2.0.0",
         "promise-all-reject-late": "^1.0.0",
@@ -10077,7 +10077,7 @@
         "diff": "^5.0.0",
         "minimatch": "^5.0.1",
         "npm-package-arg": "^9.0.1",
-        "pacote": "^13.0.5",
+        "pacote": "^13.6.1",
         "tar": "^6.1.0"
       },
       "devDependencies": {
@@ -10095,12 +10095,12 @@
       "dependencies": {
         "@npmcli/arborist": "^5.0.0",
         "@npmcli/ci-detect": "^2.0.0",
-        "@npmcli/run-script": "^3.0.0",
+        "@npmcli/run-script": "^4.1.0",
         "chalk": "^4.1.0",
         "mkdirp-infer-owner": "^2.0.0",
         "npm-package-arg": "^9.0.1",
         "npmlog": "^6.0.2",
-        "pacote": "^13.0.5",
+        "pacote": "^13.6.1",
         "proc-log": "^2.0.0",
         "read": "^1.0.7",
         "read-package-json-fast": "^2.0.2",
@@ -10170,9 +10170,9 @@
       "version": "4.1.0",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/run-script": "^3.0.0",
+        "@npmcli/run-script": "^4.1.0",
         "npm-package-arg": "^9.0.1",
-        "pacote": "^13.5.0"
+        "pacote": "^13.6.1"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^3.0.1",
@@ -10244,7 +10244,7 @@
       "license": "ISC",
       "dependencies": {
         "@npmcli/git": "^3.0.0",
-        "@npmcli/run-script": "^3.0.0",
+        "@npmcli/run-script": "^4.1.0",
         "json-parse-even-better-errors": "^2.3.1",
         "proc-log": "^2.0.0",
         "semver": "^7.3.7"
@@ -10725,7 +10725,7 @@
         "@npmcli/name-from-folder": "^1.0.1",
         "@npmcli/node-gyp": "^2.0.0",
         "@npmcli/package-json": "^2.0.0",
-        "@npmcli/run-script": "^3.0.0",
+        "@npmcli/run-script": "^4.1.0",
         "@npmcli/template-oss": "3.5.0",
         "benchmark": "^2.1.4",
         "bin-links": "^3.0.0",
@@ -10744,7 +10744,7 @@
         "npm-pick-manifest": "^7.0.0",
         "npm-registry-fetch": "^13.0.0",
         "npmlog": "^6.0.2",
-        "pacote": "^13.0.5",
+        "pacote": "^13.6.1",
         "parse-conflict-json": "^2.0.1",
         "proc-log": "^2.0.0",
         "promise-all-reject-late": "^1.0.0",
@@ -10883,9 +10883,9 @@
       }
     },
     "@npmcli/run-script": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@npmcli/run-script/-/run-script-3.0.2.tgz",
-      "integrity": "sha512-vdjD/PMBl+OX9j9C9irx5sCCIKfp2PWkpPNH9zxvlJAfSZ3Qp5aU412v+O3PFJl3R1PFNwuyChCqHg4ma6ci2Q==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/run-script/-/run-script-4.1.0.tgz",
+      "integrity": "sha512-bVX9/2YhQscdlC5WEDQ8HH7bw32klCiAvOSvUHJcmeUTUuaQ7z42KiwmnkXWqhVKKhbWPBp+5H0kN6WDyfknzw==",
       "requires": {
         "@npmcli/node-gyp": "^2.0.0",
         "@npmcli/promise-spawn": "^3.0.0",
@@ -13056,7 +13056,7 @@
         "diff": "^5.0.0",
         "minimatch": "^5.0.1",
         "npm-package-arg": "^9.0.1",
-        "pacote": "^13.0.5",
+        "pacote": "^13.6.1",
         "tap": "^16.0.1",
         "tar": "^6.1.0"
       }
@@ -13067,14 +13067,14 @@
         "@npmcli/arborist": "^5.0.0",
         "@npmcli/ci-detect": "^2.0.0",
         "@npmcli/eslint-config": "^3.0.1",
-        "@npmcli/run-script": "^3.0.0",
+        "@npmcli/run-script": "^4.1.0",
         "@npmcli/template-oss": "3.5.0",
         "bin-links": "^3.0.0",
         "chalk": "^4.1.0",
         "mkdirp-infer-owner": "^2.0.0",
         "npm-package-arg": "^9.0.1",
         "npmlog": "^6.0.2",
-        "pacote": "^13.0.5",
+        "pacote": "^13.6.1",
         "proc-log": "^2.0.0",
         "read": "^1.0.7",
         "read-package-json-fast": "^2.0.2",
@@ -13118,11 +13118,11 @@
       "version": "file:workspaces/libnpmpack",
       "requires": {
         "@npmcli/eslint-config": "^3.0.1",
-        "@npmcli/run-script": "^3.0.0",
+        "@npmcli/run-script": "^4.1.0",
         "@npmcli/template-oss": "3.5.0",
         "nock": "^13.0.7",
         "npm-package-arg": "^9.0.1",
-        "pacote": "^13.5.0",
+        "pacote": "^13.6.1",
         "tap": "^16.0.1"
       }
     },
@@ -13168,7 +13168,7 @@
       "requires": {
         "@npmcli/eslint-config": "^3.0.1",
         "@npmcli/git": "^3.0.0",
-        "@npmcli/run-script": "^3.0.0",
+        "@npmcli/run-script": "^4.1.0",
         "@npmcli/template-oss": "3.5.0",
         "json-parse-even-better-errors": "^2.3.1",
         "proc-log": "^2.0.0",
@@ -13901,14 +13901,14 @@
       }
     },
     "pacote": {
-      "version": "13.6.0",
-      "resolved": "https://registry.npmjs.org/pacote/-/pacote-13.6.0.tgz",
-      "integrity": "sha512-zHmuCwG4+QKnj47LFlW3LmArwKoglx2k5xtADiMCivVWPgNRP5QyLDGOIjGjwOe61lhl1rO63m/VxT16pEHLWg==",
+      "version": "13.6.1",
+      "resolved": "https://registry.npmjs.org/pacote/-/pacote-13.6.1.tgz",
+      "integrity": "sha512-L+2BI1ougAPsFjXRyBhcKmfT016NscRFLv6Pz5EiNf1CCFJFU0pSKKQwsZTyAQB+sTuUL4TyFyp6J1Ork3dOqw==",
       "requires": {
         "@npmcli/git": "^3.0.0",
         "@npmcli/installed-package-contents": "^1.0.7",
         "@npmcli/promise-spawn": "^3.0.0",
-        "@npmcli/run-script": "^3.0.1",
+        "@npmcli/run-script": "^4.1.0",
         "cacache": "^16.0.0",
         "chownr": "^2.0.0",
         "fs-minipass": "^2.1.0",
diff --git a/package.json b/package.json
index ed03fde449120..0bb399185b162 100644
--- a/package.json
+++ b/package.json
@@ -62,7 +62,7 @@
     "@npmcli/fs": "^2.1.0",
     "@npmcli/map-workspaces": "^2.0.3",
     "@npmcli/package-json": "^2.0.0",
-    "@npmcli/run-script": "^3.0.1",
+    "@npmcli/run-script": "^4.1.0",
     "abbrev": "~1.1.1",
     "archy": "~1.0.0",
     "cacache": "^16.1.1",
@@ -107,7 +107,7 @@
     "npm-user-validate": "^1.0.1",
     "npmlog": "^6.0.2",
     "opener": "^1.5.2",
-    "pacote": "^13.6.0",
+    "pacote": "^13.6.1",
     "parse-conflict-json": "^2.0.2",
     "proc-log": "^2.0.1",
     "qrcode-terminal": "^0.12.0",
diff --git a/test/lib/commands/edit.js b/test/lib/commands/edit.js
index 1943e8c5fb4ae..bf7bd3155bd4d 100644
--- a/test/lib/commands/edit.js
+++ b/test/lib/commands/edit.js
@@ -1,4 +1,5 @@
 const t = require('tap')
+const fs = require('fs')
 const path = require('path')
 const tspawk = require('../../fixtures/tspawk')
 const { load: loadMockNpm } = require('../../fixtures/mock-npm')
@@ -45,7 +46,14 @@ t.test('npm edit', async t => {
   spawk.spawn('testeditor', [semverPath])
   spawk.spawn(
     scriptShell,
-    args => args.includes('testinstall'),
+    args => {
+      const lastArg = args[args.length - 1]
+      const rightExtension = lastArg.endsWith('.cmd') || lastArg.endsWith('.sh')
+      const rightFilename = path.basename(lastArg).startsWith('install')
+      const rightContents = fs.readFileSync(lastArg, { encoding: 'utf8' })
+        .trim().endsWith('testinstall')
+      return rightExtension && rightFilename && rightContents
+    },
     { cwd: semverPath }
   )
   await npm.exec('edit', ['semver'])
@@ -62,7 +70,14 @@ t.test('rebuild failure', async t => {
   spawk.spawn('testeditor', [semverPath])
   spawk.spawn(
     scriptShell,
-    args => args.includes('testinstall'),
+    args => {
+      const lastArg = args[args.length - 1]
+      const rightExtension = lastArg.endsWith('.cmd') || lastArg.endsWith('.sh')
+      const rightFilename = path.basename(lastArg).startsWith('install')
+      const rightContents = fs.readFileSync(lastArg, { encoding: 'utf8' })
+        .trim().endsWith('testinstall')
+      return rightExtension && rightFilename && rightContents
+    },
     { cwd: semverPath }
   ).exit(1).stdout('test error')
   await t.rejects(
@@ -98,7 +113,14 @@ t.test('npm edit editor has flags', async t => {
   spawk.spawn('testeditor', ['--flag', semverPath])
   spawk.spawn(
     scriptShell,
-    args => args.includes('testinstall'),
+    args => {
+      const lastArg = args[args.length - 1]
+      const rightExtension = lastArg.endsWith('.cmd') || lastArg.endsWith('.sh')
+      const rightFilename = path.basename(lastArg).startsWith('install')
+      const rightContents = fs.readFileSync(lastArg, { encoding: 'utf8' })
+        .trim().endsWith('testinstall')
+      return rightExtension && rightFilename && rightContents
+    },
     { cwd: semverPath }
   )
   await npm.exec('edit', ['semver'])
diff --git a/test/lib/commands/restart.js b/test/lib/commands/restart.js
index 84bd93d8c99ca..428ecb6b2a704 100644
--- a/test/lib/commands/restart.js
+++ b/test/lib/commands/restart.js
@@ -1,3 +1,5 @@
+const fs = require('fs')
+const path = require('path')
 const t = require('tap')
 const tspawk = require('../../fixtures/tspawk')
 const { load: loadMockNpm } = require('../../fixtures/mock-npm')
@@ -26,8 +28,12 @@ t.test('should run restart script from package.json', async t => {
   })
   const [scriptShell] = makeSpawnArgs({ path: npm.prefix })
   const script = spawk.spawn(scriptShell, (args) => {
-    t.ok(args.includes('node ./test-restart.js "foo"'), 'ran restart script with extra args')
-    return true
+    const lastArg = args[args.length - 1]
+    const rightExtension = lastArg.endsWith('.cmd') || lastArg.endsWith('.sh')
+    const rightFilename = path.basename(lastArg).startsWith('restart')
+    const rightContents = fs.readFileSync(lastArg, { encoding: 'utf8' })
+      .trim().endsWith('foo')
+    return rightExtension && rightFilename && rightContents
   })
   await npm.exec('restart', ['foo'])
   t.ok(script.called, 'script ran')
diff --git a/test/lib/commands/start.js b/test/lib/commands/start.js
index 8fc73493d20a9..8f0d3c38b0935 100644
--- a/test/lib/commands/start.js
+++ b/test/lib/commands/start.js
@@ -1,3 +1,5 @@
+const fs = require('fs')
+const path = require('path')
 const t = require('tap')
 const tspawk = require('../../fixtures/tspawk')
 const { load: loadMockNpm } = require('../../fixtures/mock-npm')
@@ -10,7 +12,6 @@ const spawk = tspawk(t)
 const makeSpawnArgs = require('@npmcli/run-script/lib/make-spawn-args.js')
 
 t.test('should run start script from package.json', async t => {
-  t.plan(2)
   const { npm } = await loadMockNpm(t, {
     prefixDir: {
       'package.json': JSON.stringify({
@@ -27,8 +28,12 @@ t.test('should run start script from package.json', async t => {
   })
   const [scriptShell] = makeSpawnArgs({ path: npm.prefix })
   const script = spawk.spawn(scriptShell, (args) => {
-    t.ok(args.includes('node ./test-start.js "foo"'), 'ran start script with extra args')
-    return true
+    const lastArg = args[args.length - 1]
+    const rightExtension = lastArg.endsWith('.cmd') || lastArg.endsWith('.sh')
+    const rightFilename = path.basename(lastArg).startsWith('start')
+    const rightContents = fs.readFileSync(lastArg, { encoding: 'utf8' })
+      .trim().endsWith('foo')
+    return rightExtension && rightFilename && rightContents
   })
   await npm.exec('start', ['foo'])
   t.ok(script.called, 'script ran')
diff --git a/test/lib/commands/stop.js b/test/lib/commands/stop.js
index f2aef21899f6c..234eb2cf45382 100644
--- a/test/lib/commands/stop.js
+++ b/test/lib/commands/stop.js
@@ -1,3 +1,5 @@
+const fs = require('fs')
+const path = require('path')
 const t = require('tap')
 const tspawk = require('../../fixtures/tspawk')
 const { load: loadMockNpm } = require('../../fixtures/mock-npm')
@@ -26,8 +28,12 @@ t.test('should run stop script from package.json', async t => {
   })
   const [scriptShell] = makeSpawnArgs({ path: npm.prefix })
   const script = spawk.spawn(scriptShell, (args) => {
-    t.ok(args.includes('node ./test-stop.js "foo"'), 'ran stop script with extra args')
-    return true
+    const lastArg = args[args.length - 1]
+    const rightExtension = lastArg.endsWith('.cmd') || lastArg.endsWith('.sh')
+    const rightFilename = path.basename(lastArg).startsWith('stop')
+    const rightContents = fs.readFileSync(lastArg, { encoding: 'utf8' })
+      .trim().endsWith('foo')
+    return rightExtension && rightFilename && rightContents
   })
   await npm.exec('stop', ['foo'])
   t.ok(script.called, 'script ran')
diff --git a/test/lib/commands/test.js b/test/lib/commands/test.js
index e9ea0a3c834aa..ee6dae9024c5a 100644
--- a/test/lib/commands/test.js
+++ b/test/lib/commands/test.js
@@ -1,3 +1,5 @@
+const fs = require('fs')
+const path = require('path')
 const t = require('tap')
 const tspawk = require('../../fixtures/tspawk')
 const { load: loadMockNpm } = require('../../fixtures/mock-npm')
@@ -26,8 +28,12 @@ t.test('should run test script from package.json', async t => {
   })
   const [scriptShell] = makeSpawnArgs({ path: npm.prefix })
   const script = spawk.spawn(scriptShell, (args) => {
-    t.ok(args.includes('node ./test-test.js "foo"'), 'ran test script with extra args')
-    return true
+    const lastArg = args[args.length - 1]
+    const rightExtension = lastArg.endsWith('.cmd') || lastArg.endsWith('.sh')
+    const rightFilename = path.basename(lastArg).startsWith('test')
+    const rightContents = fs.readFileSync(lastArg, { encoding: 'utf8' })
+      .trim().endsWith('foo')
+    return rightExtension && rightFilename && rightContents
   })
   await npm.exec('test', ['foo'])
   t.ok(script.called, 'script ran')
diff --git a/workspaces/arborist/package.json b/workspaces/arborist/package.json
index baae74e25ac7b..1ea87e5774ff0 100644
--- a/workspaces/arborist/package.json
+++ b/workspaces/arborist/package.json
@@ -11,7 +11,7 @@
     "@npmcli/name-from-folder": "^1.0.1",
     "@npmcli/node-gyp": "^2.0.0",
     "@npmcli/package-json": "^2.0.0",
-    "@npmcli/run-script": "^3.0.0",
+    "@npmcli/run-script": "^4.1.0",
     "bin-links": "^3.0.0",
     "cacache": "^16.0.6",
     "common-ancestor-path": "^1.0.1",
@@ -25,7 +25,7 @@
     "npm-pick-manifest": "^7.0.0",
     "npm-registry-fetch": "^13.0.0",
     "npmlog": "^6.0.2",
-    "pacote": "^13.0.5",
+    "pacote": "^13.6.1",
     "parse-conflict-json": "^2.0.1",
     "proc-log": "^2.0.0",
     "promise-all-reject-late": "^1.0.0",
diff --git a/workspaces/arborist/tap-snapshots/test/arborist/rebuild.js.test.cjs b/workspaces/arborist/tap-snapshots/test/arborist/rebuild.js.test.cjs
index 3a500be6571ad..3a7ee889012d9 100644
--- a/workspaces/arborist/tap-snapshots/test/arborist/rebuild.js.test.cjs
+++ b/workspaces/arborist/tap-snapshots/test/arborist/rebuild.js.test.cjs
@@ -8,7 +8,7 @@
 exports[`test/arborist/rebuild.js TAP verify dep flags in script environments > saved script results 1`] = `
 Array [
   Object {
-    "cmd": "node ../../env.js",
+    "cmd": "{TMP}/postinstall-{TIMESTAMP}",
     "code": 0,
     "event": "postinstall",
     "pkg": Object {
@@ -30,7 +30,7 @@ Array [
     "stdout": "npm_package_dev\\n",
   },
   Object {
-    "cmd": "node ../../env.js",
+    "cmd": "{TMP}/postinstall-{TIMESTAMP}",
     "code": 0,
     "event": "postinstall",
     "pkg": Object {
@@ -46,7 +46,7 @@ Array [
     "stdout": "npm_package_dev_optional\\n",
   },
   Object {
-    "cmd": "node ../../env.js",
+    "cmd": "{TMP}/postinstall-{TIMESTAMP}",
     "code": 0,
     "event": "postinstall",
     "pkg": Object {
@@ -66,7 +66,7 @@ Array [
     ),
   },
   Object {
-    "cmd": "node ../../env.js",
+    "cmd": "{TMP}/postinstall-{TIMESTAMP}",
     "code": 0,
     "event": "postinstall",
     "pkg": Object {
diff --git a/workspaces/arborist/test/arborist/rebuild.js b/workspaces/arborist/test/arborist/rebuild.js
index 37551c7483386..cac811aacf99e 100644
--- a/workspaces/arborist/test/arborist/rebuild.js
+++ b/workspaces/arborist/test/arborist/rebuild.js
@@ -2,6 +2,7 @@ const t = require('tap')
 const _trashList = Symbol.for('trashList')
 const Arborist = require('../../lib/arborist/index.js')
 const { resolve, dirname } = require('path')
+const os = require('os')
 const fs = require('fs')
 const fixtures = resolve(__dirname, '../fixtures')
 const relpath = require('../../lib/relpath.js')
@@ -185,6 +186,11 @@ t.test('verify dep flags in script environments', async t => {
       localeCompare(patha, pathb) || localeCompare(eventa, eventb))
     .map(({ pkg, event, cmd, code, signal, stdout, stderr }) =>
       ({ pkg, event, cmd, code, signal, stdout, stderr }))
+  t.cleanSnapshot = (input) => {
+    return input.replace(new RegExp(os.tmpdir().replace(/\\/g, '\\\\\\\\'), 'g'), '{TMP}')
+      .replace(/\\\\/g, '/')
+      .replace(/(\d+)\.(?:sh|cmd)/g, '{TIMESTAMP}')
+  }
   t.matchSnapshot(saved, 'saved script results')
 
   for (const [pkg, flags] of Object.entries(expect)) {
diff --git a/workspaces/libnpmdiff/package.json b/workspaces/libnpmdiff/package.json
index 3630980ccb30b..e9754379d23e2 100644
--- a/workspaces/libnpmdiff/package.json
+++ b/workspaces/libnpmdiff/package.json
@@ -56,7 +56,7 @@
     "diff": "^5.0.0",
     "minimatch": "^5.0.1",
     "npm-package-arg": "^9.0.1",
-    "pacote": "^13.0.5",
+    "pacote": "^13.6.1",
     "tar": "^6.1.0"
   },
   "templateOSS": {
diff --git a/workspaces/libnpmexec/package.json b/workspaces/libnpmexec/package.json
index dfe40b0d9f7ad..ec20ea1bd3927 100644
--- a/workspaces/libnpmexec/package.json
+++ b/workspaces/libnpmexec/package.json
@@ -57,12 +57,12 @@
   "dependencies": {
     "@npmcli/arborist": "^5.0.0",
     "@npmcli/ci-detect": "^2.0.0",
-    "@npmcli/run-script": "^3.0.0",
+    "@npmcli/run-script": "^4.1.0",
     "chalk": "^4.1.0",
     "mkdirp-infer-owner": "^2.0.0",
     "npm-package-arg": "^9.0.1",
     "npmlog": "^6.0.2",
-    "pacote": "^13.0.5",
+    "pacote": "^13.6.1",
     "proc-log": "^2.0.0",
     "read": "^1.0.7",
     "read-package-json-fast": "^2.0.2",
diff --git a/workspaces/libnpmpack/package.json b/workspaces/libnpmpack/package.json
index 02f06a8bbfa3c..16d4ee1595e23 100644
--- a/workspaces/libnpmpack/package.json
+++ b/workspaces/libnpmpack/package.json
@@ -38,9 +38,9 @@
   "bugs": "https://github.com/npm/libnpmpack/issues",
   "homepage": "https://npmjs.com/package/libnpmpack",
   "dependencies": {
-    "@npmcli/run-script": "^3.0.0",
+    "@npmcli/run-script": "^4.1.0",
     "npm-package-arg": "^9.0.1",
-    "pacote": "^13.5.0"
+    "pacote": "^13.6.1"
   },
   "engines": {
     "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
diff --git a/workspaces/libnpmversion/package.json b/workspaces/libnpmversion/package.json
index 86f9737812837..c103e71b0549f 100644
--- a/workspaces/libnpmversion/package.json
+++ b/workspaces/libnpmversion/package.json
@@ -37,7 +37,7 @@
   },
   "dependencies": {
     "@npmcli/git": "^3.0.0",
-    "@npmcli/run-script": "^3.0.0",
+    "@npmcli/run-script": "^4.1.0",
     "json-parse-even-better-errors": "^2.3.1",
     "proc-log": "^2.0.0",
     "semver": "^7.3.7"