There is "OS Command Injection" vulnerability on "is-program-installed" npm package before 2.3.4. This package tries to understand the given parameter name (program or binary name) is installed in the computer or not. However, since this package does not properly control the characters in the program name taken as input, it is possible to run commands on the operating system.