Potential command injection vulnerability in npm-dependency-versions

[xiaofen9]

Hi,

Thanks for devloping this great npm package! We find a potential command injection vulnerabilty from it. The bug is caused by the fact that package-exported method fail to sanitize pkgs parameter and let it flow into a sensitive command execution API.

Here is the proof of concept.

const dependencyVersions = require("./index.js")
dependencyVersions({"pkgs":["|touch rce"]})

Please consider fix it. thanks!