harden: sanitize shell/subprocess call in package.json (CWE-78)

[anupamme]

The package.json includes shelljs ^0.8.4 as a dependency, which is used in build and deployment scripts. While the provided code snippets do not show the actual build script implementations, shelljs is commonly used for shell command execution. The combination of shelljs with user-controlled input creates a command injection risk if any script uses shelljs.exec() or similar functions with unsanitized input. This is defence-in-depth at package.json:16 rather than a vulnerability I can show is exploitable here — it makes the failure mode explicit and bounded. Close it freely if the pattern is intentional.

Reference: CWE-78

What changed

• package.json

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

Regression test

The security boundary is maintained under adversarial input

Test

const { exec } = require('shelljs');

describe("shelljs.exec must not execute injected commands from user input", () => {
  const payloads = [
    "; cat /etc/passwd",
    "$(whoami)",
    "valid-argument"
  ];

  test.each(payloads)("treats payload as literal argument, not command: %s", (payload) => {
    const originalExitCode = process.exitCode;
    const result = exec(`echo "${payload}"`, { silent: true });
    
    const hasInjectionArtifacts = 
      result.stdout.includes("/etc/passwd") ||
      result.stdout.includes("\n") ||
      result.stdout.includes("root:");
    
    expect(hasInjectionArtifacts).toBe(false);
    expect(result.code).toBe(0);
  });
});

---

Automated security fix by OrbisAI Security