[extra-asciinema] Command Injection via insecure command formatting

I would like to report a `Command Injection` issue in the `extra-asciinema` module. It allows to execute arbitrary commands on the victim's PC.

// https://github.com/nodef/extra-asciinema/blob/master/index.js#L214
...
const cp9 = require('child_process');
...
/**
 * Upload recorded asciicast to asciinema.org site.
 * @param {string} f filename
 * @returns {string} asciicast URL
 */
function uploadSync(f) {
  var stdout = …