@Mborne/Extract (< 0.2.1)

The @mborne/extract library before version 0.2.1 is vulnerable to OS command injection via unsanitized archivePath or targetDir inputs passed to shelljs exec().