Review: Prevent shell expansion with single quotes

node:child_process.exec executes the given command in a shell. While the
input here comes from npm, it is still good to make sure that the
package name argument is not expanded by the shell.

Author: weirdwater

packages/pluggable-widgets-tools/src/commands/audit.ts

@@ -97,7 +97,7 @@ interface UpdateablePackage {
  * Using the ^ version range avoids this, as the version is specific enough for npm.
  */
 async function findSafeVersion({ name, range }: NpmAudit.Dependency): Promise<UpdateablePackage> {
-    const versions = await promisify(exec)(`npm show ${name} versions --json`).then(
+    const versions = await promisify(exec)(`npm show '${name}' versions --json`).then(
         ({ stdout }) => JSON.parse(stdout) as string[]
     );