Command execution via missing zip option delimiter

Argument injection in Nathan Friedly bestzip before 2.2.6 and 3.0.0 through 3.0.1 allows attackers to execute shell commands. The native zip argument builder passes destination and source operands without a -- delimiter, letting hyphen-prefixed source paths become -T and -TT options that invoke a shell command. Exploitation requires an application to pass attacker-controlled source paths to the native zip backend; the command runs with the Node.js process privileges.