This module could be an interactive npm command launcher, it just needs 2 changes:

• export doNpmCommand() like npm.command
• change function doNpmCommand(options, cb) { to function doNpmCommand(command, options, cb) { so it can be used like this var npmLs = npm.custom.bind(null, 'ls')

I have made some experiments on my own, this functionality seems very easy, for now I am not compiling a PR because there are many PR still pending and collabs/owner does not seem really responsive on that..

just reply if there is any interest in this feature

This issue has been generated on-behalf of Mik317 (https://huntr.dev/app/users/Mik317)

Vulnerability Description

The issue occurs because a user input is formatted inside a command that will be executed without any check. The issue arises here: https://github.com/balderdashy/enpeem/blob/master/index.js#L82 . The options should be inserted in the 2' position as arguments and not be concatenated inside the main command without any check.

POC

// poc.js
var npm = require('enpeem');
npm.update({production:'test; touch HACKED; #', path:''});

Impact

RCE via command formatting on `enpeem

Bug Bounty

We have opened up a bounty for this issue on our bug bounty platform. Want to solve this vulnerability and get rewarded 💰? Go to https://huntr.dev/

We will submit a pull request directly to your repository with the fix as soon as possible. Want to learn more? Go to https://github.com/418sec/huntr 📚

Automatically generated by @huntr-helper...

This is more a personal todo:
For Sane Stack I need a simple option to not actually run the npm-install and immediately return, an options to have a 'dry-run', which just saves the packages to the package.json without actually installing them, as well as prefixing something to the npm install command so it can be run in docker containers. That would be docker-compose run server for example.

Have the functionality for this locally in my code right now - will move that to enpeem with time :)