@cyclonedx/cyclonedx-npm

@cyclonedx/cyclonedx-npm command injection via --workspace with unset npm_execpath

Command injection vulnerability when using --workspace option with unset or empty npm_execpath environment variable.