jeemok CVE debriefs

CVE-2026-57998

The better-npm-audit package through version 3.11.0 and 4.0.0-rc.2 is vulnerable to OS command injection via the --registry option. This occurs because the package interpolates user-supplied input into a command string without validation or quoting, then executes it using child_process.exec(). An attacker could exploit this by providing a registry value containing shell metacharacters, leading to arbitrar [truncated]