A critical command injection vulnerability exists in electerm versions prior to 3.3.8. The flaw occurs in the npm install script on macOS, where unvalidated remote release metadata is passed to a system command, allowing arbitrary command execution. This affects users who run 'npm install -g electerm' on macOS. The issue has been fixed in version 3.3.8, which is already published on npm. No workarounds are available other than upgrading.