Arbitrary code execution via recursive plugin globbing

Code injection in Tygo van den Hurk Slyde before 0.0.5 allows attackers to execute arbitrary code through a malicious npm package. The default plugin option in src/commands/base.ts recursively expands broad JavaScript globs and imports matching files inside node_modules without excluding dependency code. Exploitation requires a malicious package with a matching plugin file to be installed and Slyde to run from a parent directory; its code runs with the Slyde process's privileges.