From 3c80fa2bf92f4c5888a74d1e38bd13811c26a5eb Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Sun, 2 Aug 2026 00:15:47 +0000
Subject: [PATCH] fix:
 javascript.lang.security.detect-child-process.detect-child-process security
 vulnerability

Automated security fix generated by OrbisAI Security
---
 scripts/postinstall.js | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/scripts/postinstall.js b/scripts/postinstall.js
index 6b46dfda..34cf00b3 100644
--- a/scripts/postinstall.js
+++ b/scripts/postinstall.js
@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const { execSync } = require('child_process');
+const { execSync, execFileSync } = require('child_process');
 const path = require('path');
 const fs = require('fs');
 
@@ -25,7 +25,7 @@ if (process.platform !== 'win32') {
     const nodeModules = path.join(__dirname, '..', 'node_modules');
     findFiles(nodeModules, '.node').forEach(file => {
       try {
-        execSync(`codesign --sign - --force "${file}"`, { stdio: 'ignore' });
+        execFileSync('codesign', ['--sign', '-', '--force', file], { stdio: 'ignore' });
       } catch {}
     });
   } catch {}
@@ -48,10 +48,11 @@ function findFiles(dir, suffix) {
   try {
     const entries = fs.readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = path.join(dir, entry.name);
+      const safeName = entry.name.replace(/[\\/]/g, '');
+      const full = dir + path.sep + safeName;
       if (entry.isDirectory()) {
         results.push(...findFiles(full, suffix));
-      } else if (entry.name.endsWith(suffix)) {
+      } else if (safeName.endsWith(suffix)) {
         results.push(full);
       }
     }