The vulnerability stems from unsanitized use of config.FunctionName in command construction. The Snyk advisory specifically references line 78 in lib/main.js where zipCmd is built using config.FunctionName. As this is passed directly to exec, the deploy function that orchestrates this process becomes the primary vulnerable entry point. The function name 'deploy' matches the CLI command and module's main interface for deployment operations.