Node.js third-party modules: [devcert] Command Injection via insecure command formatting

I would like to report a Command Injection issue in the devcert module. It allows to execute arbitrary commands on the victim's PC. Module module name: devcert version: 1.1.0 npm page: https://www.npmjs.com/package/devcert Module Description devcert - Development SSL made easy Module Stats [276,467] weekly downloads Vulnerability Vulnerability Description The issue occurs because a user input parameter is used inside a command that is executed without any check. I tested the certificateFor function. Here's the code which causes the issue: ```javascript // https://github.com/davewasmer/devcert/blob/2b1b8d40eda251616bf74fd69f00ae8222ca1171/src/index.ts#L95 export async function certificateFor(domain: string, options: O = {} as O): Promise> { // <-- starting point debug(Certificate requested for ${ domain }. Skipping certutil install: ${ Boolean(options.skipCertutilInstall) }. Skipping hosts file: ${ Boolean(options.skipHostsFile) }); if (options.ui) { Object.assign(UI, options.ui); } if (!isMac && !isLinux && !isWindows) { throw new Error(Platform not supported: "${ process.platform }"); } if (!commandExists('openssl')) { throw new Error('OpenSSL not found: OpenSSL is required to generate SSL certificates - make sure it is installed and available in your PATH'); } let domainKeyPath = pathForDomain(domain, private-key.key); let domainCertPath = pathForDomain(domain, certificate.crt); if (!exists(rootCAKeyPath)) { debug('Root CA is not installed yet,...