It turns out this question isn't trivial to answer using Node's built-in path APIs. A naive indexOf-based solution will fail sometimes on Windows, which is case-insensitive (see e.g. isaacs/npm#4214). You might then think to be clever with path.resolve, but you have to be careful to account for situations whether the paths have different drive letters, or else you'll cause bugs like isaacs/npm#4313. And let's not even get started on trailing slashes. The path-is-inside package will give you a robust, cross-platform way of detecting whether a given path is inside another path.