Package `ssh2` had OS Command Injection bug in versions previous to v0.8.5: https://github.com/advisories/GHSA-652h-xwhf-q4h6