Description
Affected versions of `pidusage` pass unsanitized input to `child_process.exec()`, resulting in arbitrary code execution in the `ps` method.
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.
Windows and Linux are not vulnerable.
## Proof of Concept
```
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
```
## Recommendation
Update to version 1.1.5 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | pidusage | < 1.1.5 | 1.1.5 | GHSA-hfq9-rfpv-j8r8 |