All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. * if Alice uses tzdata pipeline to package moment-timezone on her own (for example via "grunt data:2014d", where "2014d" stands for the version of the tzdata to be used from IANA's website), * and Alice let's Mallory select the version ("2014d" in our example), then Mallory can execute arbitrary commands on the machine running the grunt task, with the same privilege as the grunt task