Command Injection

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Command Injection via the getRemotePackageInfo function due to improper input sanitization. PoC js var root = require"get-global-packages" root.getRemotePackageInfo"name":"& touch JHU &"...