Command Injection vulnerability in kill-port-process package

I would like to report a command injection vulnerability in the kill-port-process package. It allows an attacker to inject arbitrary commands.

const killPortProcess = require('kill-port-process');
const PORT = "$(<Shell Command>)";
await killPortProcess(PORT);