npm search RCE? - Escape Sequence Injection

How many programmers does it take to filter out 36 characters? You may think this is an opening to a joke, but it’s not.