[vboxmanage.js] Command Injection via insecure command concatenation

I would like to report a `Command Injection` issue in the `vboxmanage.js` module. It allows to execute arbitrary commands on the victim's PC.

// https://github.com/danielgindi/node-vboxmanage/blob/master/index.js#L76
...
var
    child_process = require('child_process'),
...
VBoxManage.manage = function (command, options) {

    command = command || [];
    if (!(command instanceof Array)) {
        command = [command];
    }

    options …