Advisory Weakness Curation

Command Injection in whereis Versions of `whereis` before 0.4.1 are vulnerable to command injection if untrusted user input is passed into `whereis`. ## Recommendation Update to version 0.4.1 or later.

Improper Input Validation Concatenating unsanitized user input in the `whereis` npm module allows an attacker to execute arbitrary commands. The `whereis` module is deprecated and it is recommended to use the `which` npm module instead.