use NOFOLLOW

src/shell/builtin/rm.zig

@@ -830,7 +830,7 @@ pub const ShellRmTask = struct {
             return Maybe(void).initErr(Syscall.Error.fromCode(bun.sys.E.ISDIR, .TODO).withPath(bun.handleOom(bun.default_allocator.dupeZ(u8, dir_task.path))));
         }
 
-        const flags = bun.O.DIRECTORY | bun.O.RDONLY;
+        const flags = bun.O.DIRECTORY | bun.O.RDONLY | bun.O.NOFOLLOW;
         const fd = switch (ShellSyscall.openat(dirfd, path, flags, 0)) {
             .result => |fd| fd,
             .err => |e| {

test/js/bun/shell/commands/rm.test.ts

@@ -25,10 +25,15 @@ const BUN = process.argv0;
 const DEV_NULL = process.platform === "win32" ? "NUL" : "/dev/null";
 
 describe.concurrent("bunshell rm", () => {
-  TestBuilder.command`echo ${packagejson()} > package.json; ${BUN} install &> ${DEV_NULL}; rm -rf node_modules/`
+  TestBuilder.command`echo ${hoistedPackageJson()} > package.json; ${BUN} install --linker hoisted &> ${DEV_NULL}; rm -rf node_modules/`
     .ensureTempDir()
     .doesNotExist("node_modules")
-    .runAsTest("node_modules");
+    .runAsTest("hoisted node_modules");
+
+  TestBuilder.command`echo ${isolatedPackageJson()} > package.json; ${BUN} install --linker isolated &> ${DEV_NULL}; rm -rf node_modules/`
+    .ensureTempDir()
+    .doesNotExist("node_modules")
+    .runAsTest("isolated node_modules");
 
   test("force", async () => {
     const files = {
@@ -146,7 +151,7 @@ foo/
   });
 });
 
-function packagejson() {
+function hoistedPackageJson() {
   return `{
   "name": "dummy",
   "dependencies": {
@@ -171,3 +176,12 @@ function packagejson() {
   "version": "0.0.0"
 }`;
 }
+
+function isolatedPackageJson() {
+  return `{
+  "name": "pkg",
+  "dependencies": {
+    "react": "next"
+  }
+}`;
+}