Detected calls to child_process from a function argument `f`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. 
var cp = child_process.spawn(cmd, args, { env: env, cwd: relDir })