better‑npm‑audit builds its npm audit command by inserting the user‑supplied --registry value directly into a shell command string and passes that string to child_process.exec(), which launches a shell. Because the registry argument is not validated or quoted, a value that contains shell metacharacters such as ;, | or $(…) can cause arbitrary operating‑system commands to run with the same privileges as the audit process. This flaw allows a malicious user to execute system commands on the host that runs the audit, leading to full compromise of the container, VM, or developer machine where the tool is invoked.

This vulnerability exists in jeemok better‑npm‑audit up through version 3.11.0 and the 4.0.0‑rc.2 prerelease. All installations running these or earlier releases are affected. No information is available about whether newer releases include the fix, so uncertainty remains about the status of later versions.

The CVSS score of 8.5 indicates a high severity. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is a local or semi‑remote action; it is inferred that anyone who can invoke the tool can supply a malicious --registry flag, thereby triggering the command execution. The exploitation process requires only the ability to run the audit command with a crafted registry option; no network service or elevated privileges are necessary for the initial trigger. Once triggered, the attacker gains the same shell access as the audit process, which can be sufficient to compromise the host, exfiltrate data, or modify the environment.