Fix shell injection in install command

[densign01]

Summary

• Replaces execSync with execFileSync in the slopcop install command to prevent shell metacharacter injection via package names
• Package names are now passed as an args array instead of interpolated into a shell string

Problem

execSync("npm install " + pkg) passes the command through /bin/sh -c, which means shell metacharacters in the package name are interpreted. For example:

slopcop install "chalk; echo PWNED > /tmp/test"

...would run npm install chalk and echo PWNED > /tmp/test as separate shell commands.

Fix

Switch to execFileSync("npm", ["install", pkg]), which invokes the binary directly without a shell. The package name is passed as a single argument, so metacharacters are treated as literal characters.

Testing

Verified before/after:

• Before: slopcop install "chalk; echo PWNED > /tmp/test" creates the file (shell injection works)
• After: npm receives the entire string as one package name argument, fails with ENOENT (no injection)

Normal slopcop install chalk and slopcop check chalk continue to work as expected.