The wrapper is written through an unquoted heredoc, so the package and bin
names land in it as shell source. A package name carrying shell characters
became code that ran every time the wrapper ran.
The command name is used raw as a file name under ~/.local/bin, so a slash in
it wrote and removed somewhere else entirely.
Quote both values with printf %q, and refuse command names that are not plain
file names before anything is removed or written.
Adolanium
b6a8f2453f