diff --git a/run-build-functions.sh b/run-build-functions.sh
index 79eb891e..c85f7b26 100755
--- a/run-build-functions.sh
+++ b/run-build-functions.sh
@@ -264,7 +264,7 @@ run_npm() {
   then
     echo "Bypassing sha validation. Running pre & post install scripts"
     echo "Installing npm packages using npm version $(npm --version)"
-    if npm install ${NPM_FLAGS:+"$NPM_FLAGS"}
+    if npm install ${NPM_FLAGS:+$NPM_FLAGS}
     then
       echo "npm packages installed"
     else
diff --git a/tests/node/bypass_cache.bats b/tests/node/bypass_cache.bats
index b0497031..087f0efa 100755
--- a/tests/node/bypass_cache.bats
+++ b/tests/node/bypass_cache.bats
@@ -7,7 +7,7 @@ load '../../node_modules/bats-assert/load'
 load '../../node_modules/bats-file/load'
 
 setup() {
-  
+
   NETLIFY_CACHE_DIR="/opt/buildhome/cache"
   TMP_DIR=$(setup_tmp_dir)
   NODE_VERSION=14
@@ -31,3 +31,9 @@ teardown() {
   run run_npm "buildbot_other_flags"
   assert_output --partial "Creating package sha"
 }
+
+@test 'bypass_cache can handle multiple NPM_FLAGS' {
+  NPM_FLAGS="--no-audit --legacy-peer-deps"
+  run run_npm "buildbot_other_flags"
+  refute_output --partial "audit"
+}