OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)

**Asset:** `aws-cdk-lib` (npm package), source: https://github.com/aws/aws-cdk **Severity:** High **CWE:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command, 'OS Command Injection')

public write(filePath: string, data: string): string {
    // ...
    return `echo '${data}' > "${filePath}"`;
    //           ^ NO ESCAPING — single quotes in data break out
}