Cpe:2.3:a:mborne:extract:*:*:*:*:*:node.js:*:*

The @mborne/extract library before version 0.2.1 is vulnerable to OS command injection via unsanitized archivePath or targetDir inputs passed to shelljs exec().