[extra-ffmpeg] Command Injection via insecure command formatting

I would like to report a `Command Injection` issue in the `extra-ffmpeg` module. It allows to execute arbitrary commands on the victim's PC.

// https://github.com/nodef/extra-ffmpeg/blob/master/index.js#L19
const cp = require('child_process');


// Global variables.
const STDIO = [0, 1, 2];


 // Generate command for ffmpeg.
 function command(os) {
  var z = 'ffmpeg';
  var os = os||[];
  for(var o of os) {
    var o = o||{}; …