Review Node child_process and dynamic requires

In Node, exec uses a shell while execFile and spawn with an args array do not. Dynamic require and vm evaluate code.

grep -rEn "child_process|.exec(|execSync(|vm.(runInNewContext|Script)|require([^'"]" --include=*.{js,ts} .

The bug is a shell string or a tainted module path.

exec(`convert ${file} out.png`);   // file="x; rm -rf /"
require(`./handlers/${name}`);      // path traversal to arbitrary module

Pro note: recommend execFile with an argument array and an allow-list for dynamic requires. Also check merge and assign helpers for prototype pollution, since a polluted default can silently reintroduce a shell option into an otherwise safe spawn.