Arbitrary Command Injection

sharp is vulnerable to arbitrary command injection. An attacker is able to set the value of the PKG_CONFIG_PATH environment variable in a build environment which allows arbitrary command injection at npm install time.