fix(mama): remove ./node_modules/.bin/ from scripts and integrity hash

.changeset/giant-papers-cheat.md

@@ -0,0 +1,5 @@
+---
+"@nodesecure/mama": patch
+---
+
+Remove ./node_modules/.bin/ from scripts and integrity hash

workspaces/mama/src/utils/integrity-hash.ts

@@ -52,11 +52,28 @@ export function packageJSONIntegrityHash(
     version,
     dependencies,
     license,
-    scripts
+    /**
+     * Note: NPM registry automatically add `./node_modules/.bin/` to scripts
+     * This artifact do not concern raw scripts in the tarball package.json.
+     */
+    scripts: isFromRemoteRegistry ?
+      removeNodeModulesBin(scripts) :
+      scripts
   };
 
   return {
     object,
     integrity: hash(object)
   };
 }
+
+function removeNodeModulesBin(
+  scripts: Record<string, string>
+) {
+  return Object.fromEntries(
+    Object.entries(scripts).map(([key, value]) => [
+      key,
+      value.replaceAll("./node_modules/.bin/", "")
+    ])
+  );
+}

workspaces/mama/test/packageJSONIntegrityHash.spec.ts

@@ -48,4 +48,18 @@ describe("packageJSONIntegrityHash", () => {
       kMinimalPackageJSONIntegrity
     );
   });
+
+  test("Given a script with an instance of './node_modules/.bin/'", () => {
+    const { object } = packageJSONIntegrityHash({
+      ...kMinimalPackageJSON,
+      scripts: {
+        test: "./node_modules/.bin/istanbul cover ./node_modules/tape/bin/tape ./test/integration/*.js"
+      }
+    }, { isFromRemoteRegistry: true });
+
+    assert.strictEqual(
+      object.scripts.test,
+      "istanbul cover ./node_modules/tape/bin/tape ./test/integration/*.js"
+    );
+  });
 });