Update package shell quote

[bcomnes]

Closes GHSA-g4rg-993r-mgx7

[codecov-commenter]

Codecov Report

Merging #89 (5ce62d4) into master (8e72b7c) will increase coverage by 3.48%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master      #89      +/-   ##
==========================================
+ Coverage   92.66%   96.15%   +3.48%     
==========================================
  Files          23       22       -1     
  Lines         477     1923    +1446     
==========================================
+ Hits          442     1849    +1407     
- Misses         35       74      +39     

Flag	Coverage Δ
ubuntu-latest-12	?
ubuntu-latest-14	?
ubuntu-latest-18	96.15% <ø> (?)
windows-latest-12	?
windows-latest-14	?

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
lib/spawn-posix.js	96.87% <0.00%> (-3.13%)	⬇️
bin/common/parse-cli-args.js	92.82% <0.00%> (-0.43%)	⬇️
lib/spawn.js	100.00% <0.00%> (ø)
bin/run-p/help.js	100.00% <0.00%> (ø)
bin/run-s/help.js	100.00% <0.00%> (ø)
bin/run-p/index.js	100.00% <0.00%> (ø)
bin/run-s/index.js	100.00% <0.00%> (ø)
lib/match-tasks.js	100.00% <0.00%> (ø)
bin/common/version.js	100.00% <0.00%> (ø)
bin/common/bootstrap.js	100.00% <0.00%> (ø)
... and 13 more

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more