diff --git a/app/windows/codesign.js b/app/windows/codesign.js
index 7f87a657d4..a24e3a1a4a 100644
--- a/app/windows/codesign.js
+++ b/app/windows/codesign.js
@@ -1,4 +1,4 @@
-const { exec } = require('child_process');
+const { execFile } = require('child_process');
 const path = require('path');
 const os = require('os');
 const fs = require('fs');
@@ -145,8 +145,9 @@ function sign(esrpTool, pathToSign) {
   const authJson = path.resolve(os.tmpdir(), 'Auth.json');
   fs.writeFileSync(authJson, JSON.stringify(AUTH_JSON, undefined, 2));
 
-  exec(
-    `${esrpTool} Sign -a ${authJson} -p ${policyJson} -i ${signInputJson}`,
+  execFile(
+    esrpTool,
+    ['Sign', '-a', authJson, '-p', policyJson, '-i', signInputJson],
     (error, stdout, stderr) => {
       if (error) {
         console.log(`error: ${error.message}`);
diff --git a/frontend/src/make-env.test.js b/frontend/src/make-env.test.js
index 638859a990..5c45598ce9 100644
--- a/frontend/src/make-env.test.js
+++ b/frontend/src/make-env.test.js
@@ -1,13 +1,13 @@
 const os = require('os');
 const path = require('path');
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const { readFileSync } = require('fs');
 
 const envFile = path.join(os.tmpdir(), 'tmpEnv');
 
 test('Create & verify', () => {
   const execFile = path.resolve(path.join(__dirname, '..', 'make-env.js'));
-  execSync(`node ${execFile} ${envFile}`);
+  execFileSync('node', [execFile, envFile]);
 
   const envContents = readFileSync(envFile).toString();
 
diff --git a/plugins/headlamp-plugin/bin/headlamp-plugin.js b/plugins/headlamp-plugin/bin/headlamp-plugin.js
index 59b3373cd2..8da6279541 100755
--- a/plugins/headlamp-plugin/bin/headlamp-plugin.js
+++ b/plugins/headlamp-plugin/bin/headlamp-plugin.js
@@ -549,8 +549,10 @@ function runScriptOnPackages(packageFolder, scriptName, cmdLine, env) {
 
     console.log(`"${folder}": ${scriptName}-ing, :${cmdLineToUse}:...`);
 
+    const [cmd, ...args] = cmdLineToUse.split(' ');
+
     try {
-      child_process.execSync(cmdLineToUse, {
+      child_process.execFileSync(cmd, args, {
         stdio: 'inherit',
         encoding: 'utf8',
         env: { ...process.env, ...(env || {}) },
diff --git a/plugins/headlamp-plugin/test-headlamp-plugin.js b/plugins/headlamp-plugin/test-headlamp-plugin.js
index 596e02b3ac..905659904c 100755
--- a/plugins/headlamp-plugin/test-headlamp-plugin.js
+++ b/plugins/headlamp-plugin/test-headlamp-plugin.js
@@ -13,9 +13,9 @@ function testHeadlampPlugin() {
   cleanup();
 
   // Make a package file of headlamp-plugin we can test
-  run('npm install');
-  run('npm run build');
-  run('npm pack');
+  run('npm', ['install']);
+  run('npm', ['run', 'build']);
+  run('npm', ['pack']);
 
   const packedFile = fs
     .readdirSync('.')
@@ -23,29 +23,29 @@ function testHeadlampPlugin() {
   console.log('Packed headlamp-plugin package file:', packedFile);
 
   // Use "link" to test the repo version of the headlamp-plugin tool.
-  run('npm link');
-  run(`node bin/headlamp-plugin.js create ${PACKAGE_NAME} --link`);
+  run('npm', ['link']);
+  run('node', ['bin/headlamp-plugin.js', 'create', PACKAGE_NAME, '--link']);
   curDir = join('.', PACKAGE_NAME);
-  run(`npm install ${join('..', packedFile)}`);
+  run('npm', ['install', join('..', packedFile)]);
 
   // test headlamp-plugin build
-  run(`node ${join('..', 'bin', 'headlamp-plugin.js')} build`);
+  run('node', [join('..', 'bin', 'headlamp-plugin.js'), 'build']);
   checkFileExists(join(PACKAGE_NAME, 'dist', 'main.js'));
 
   // test headlamp-plugin build folder
   curDir = '.';
   fs.rmSync(PACKAGE_NAME, { recursive: true });
-  run(`node bin/headlamp-plugin.js create ${PACKAGE_NAME} --link`);
+  run('node', ['bin/headlamp-plugin.js', 'create', PACKAGE_NAME, '--link']);
   curDir = PACKAGE_NAME;
-  run(`npm install ${join('..', packedFile)}`);
+  run('npm', ['install', join('..', packedFile)]);
   curDir = '.';
-  run(`node bin/headlamp-plugin.js build ${PACKAGE_NAME}`);
+  run('node', ['bin/headlamp-plugin.js', 'build', PACKAGE_NAME]);
   checkFileExists(join(PACKAGE_NAME, 'dist', 'main.js'));
 
   fs.writeFileSync(join(PACKAGE_NAME, 'dist', 'extra.txt'), 'All dist/ files will be copied.');
 
   // test extraction works
-  run(`node bin/headlamp-plugin.js extract . .plugins`);
+  run('node', ['bin/headlamp-plugin.js', 'extract', '.', '.plugins']);
   checkFileExists(join('.plugins', PACKAGE_NAME, 'main.js'));
   checkFileExists(join('.plugins', PACKAGE_NAME, 'package.json'));
   // make sure extra files in dist/ folder are copied too
@@ -53,29 +53,29 @@ function testHeadlampPlugin() {
 
   // test packing works
   const tmpDir = fs.mkdtempSync('headlamp-plugin-test-');
-  run(`node bin/headlamp-plugin.js package ${PACKAGE_NAME} ${tmpDir}`);
+  run('node', ['bin/headlamp-plugin.js', 'package', PACKAGE_NAME, tmpDir]);
   checkFileExists(join(tmpDir, `${PACKAGE_NAME}-0.1.0.tar.gz`));
   // extract archive and check files
   const extractionFolder = join(tmpDir, 'dst');
   fs.mkdirSync(extractionFolder, { recursive: true });
-  run(`tar -xzf ${join(tmpDir, `${PACKAGE_NAME}-0.1.0.tar.gz`)} -C ${extractionFolder}`);
+  run('tar', ['-xzf', join(tmpDir, `${PACKAGE_NAME}-0.1.0.tar.gz`), '-C', extractionFolder]);
   checkFileExists(join(extractionFolder, `${PACKAGE_NAME}`, 'main.js'));
   checkFileExists(join(extractionFolder, `${PACKAGE_NAME}`, 'package.json'));
   fs.rmSync(tmpDir, { recursive: true });
 
   // test format command and that default code is formatted correctly
   fs.rmSync(PACKAGE_NAME, { recursive: true });
-  run(`node bin/headlamp-plugin.js create ${PACKAGE_NAME} --link`);
+  run('node', ['bin/headlamp-plugin.js', 'create', PACKAGE_NAME, '--link']);
   curDir = PACKAGE_NAME;
-  run(`npm install ${join('..', packedFile)}`);
-  run('npm run format');
+  run('npm', ['install', join('..', packedFile)]);
+  run('npm', ['run', 'format']);
 
   // test lint command and default code is lint free
-  run('npm run lint');
-  run('npm run lint-fix');
+  run('npm', ['run', 'lint']);
+  run('npm', ['run', 'lint-fix']);
 
   // test type script error checks
-  run('npm run tsc');
+  run('npm', ['run', 'tsc']);
 
   // test the storybook builds
   // TODO: Reenable after storybook is fixed
@@ -90,7 +90,7 @@ function testHeadlampPlugin() {
   filesToRemove.forEach(file => {
     fs.rmSync(join(curDir, file), { recursive: true });
   });
-  run(`node ${join('..', 'bin', 'headlamp-plugin.js')} upgrade --skip-package-updates`);
+  run('node', [join('..', 'bin', 'headlamp-plugin.js'), 'upgrade', '--skip-package-updates']);
   checkFileExists(join(curDir, 'tsconfig.json'));
   checkFileExists(join(curDir, 'src', 'headlamp-plugin.d.ts'));
   checkFileExists(join(curDir, '.vscode', 'extensions.json'));
@@ -110,7 +110,7 @@ function testHeadlampPlugin() {
   fs.writeFileSync(packageJsonPath, changedJson);
 
   // test upgrade updates the package line, and the old version is not in there
-  run(`node ${join('..', 'bin', 'headlamp-plugin.js')} upgrade`);
+  run('node', [join('..', 'bin', 'headlamp-plugin.js'), 'upgrade']);
   const oldVersion = '0.4.9';
   if (fs.readFileSync(packageJsonPath, 'utf8').includes(oldVersion)) {
     exit(`Error: old version still in ${packageJsonPath}`);
@@ -143,18 +143,26 @@ function cleanup() {
     .forEach(folder => fs.rmSync(folder, { recursive: true }));
 }
 
-function run(cmd) {
+function run(cmd, args) {
   console.log('');
-  console.log(`Running cmd:${cmd} inside of cwd:${curDir} abs: "${resolve(curDir)}"`);
+  console.log(
+    `Running cmd:${cmd} with args:${args.join(' ')} inside of cwd:${curDir} abs: "${resolve(
+      curDir
+    )}"`
+  );
   console.log('');
   try {
-    child_process.execSync(cmd, {
+    child_process.execFileSync(cmd, args, {
       stdio: 'inherit',
       cwd: curDir,
       encoding: 'utf8',
     });
   } catch (e) {
-    exit(`Error: Problem running "${cmd}" inside of "${curDir}" abs: "${resolve(curDir)}"`);
+    exit(
+      `Error: Problem running "${cmd} ${args.join(' ')}" inside of "${curDir}" abs: "${resolve(
+        curDir
+      )}"`
+    );
   }
 }
 function checkFileExists(fname) {