@plugin.land/run-command NPM

Avoid using child_process.exec, and never use it if the command contains any input that changes based on user input.
Try to avoid letting users pass in options to commands if possible. Typically values are okay when using spawn or execfile, but selecting options via a user controlled string is a bad idea.
If you must allow for user controlled options, look at the options for the command extensively, determine which options are safe, and whitelist only those options.