Package's name is not sanitized/escaped

[mani3xis]

The package.json's name field can be scoped (e.g. @callstack) and can contain a / character. As this is user-controlled input, it needs to be escaped, so that it's not used as path separator. Currently, this is not sanitized and passed directly into (basically) system calls. The directories that are created during "auto linking" contain the @ in their name (which is a legal character for a file and directory name on both Windows and POSIX). However, the / is also not escaped which causes issues while building.

Here's a snippet of the getLibraryName() function from path-utils.ts (from here):

export function getLibraryName(modulePath: string, naming: NamingStrategy) {
  const { packageName, relativePath } = determineModuleContext(modulePath);
  return naming.stripPathSuffix
    ? packageName
    : `${packageName}--${escapePath(relativePath)}`;
}

This issue can also be exploited, as nothing stops "an attacker" to create a package, whose name starts with @rpath/... or @executable_path/ just to name a few.