Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. 
var c = child.exec(cmd, {env: process.env, maxBuffer: 20*1024*1024}, function(err) {