diff --git a/beancount_bot_costflow/__init__.py b/beancount_bot_costflow/__init__.py
index 0647e03..72b8a5e 100644
--- a/beancount_bot_costflow/__init__.py
+++ b/beancount_bot_costflow/__init__.py
@@ -2,4 +2,4 @@
 
 __AUTHOR__ = 'KAAAsS'
 __LICENSE__ = "GPLv3"
-__VERSION__ = "1.0.1"
+__VERSION__ = "1.0.3"
diff --git a/beancount_bot_costflow/beancount_bot_costflow.py b/beancount_bot_costflow/beancount_bot_costflow.py
index 53cb9ef..3fc1163 100644
--- a/beancount_bot_costflow/beancount_bot_costflow.py
+++ b/beancount_bot_costflow/beancount_bot_costflow.py
@@ -48,7 +48,7 @@ def _process_raw(self, input_str: str) -> str:
                 ['node', _SCRIPT_PATH,
                  '--config', self.config,
                  '--json',
-                 input_str], stderr=subprocess.STDOUT, shell=True, timeout=3,
+                 input_str], stderr=subprocess.STDOUT, timeout=3,
                 universal_newlines=True)
         except subprocess.CalledProcessError as e:
             logger.error(f'Costflow 解析错误：{e.output}', e)
diff --git a/setup.py b/setup.py
index 826e02f..5e6b9a8 100644
--- a/setup.py
+++ b/setup.py
@@ -12,6 +12,7 @@
     name='beancount_bot_costflow',
     version=__VERSION__,
     packages=['beancount_bot_costflow'],
+    package_data={'': ['costflow-parser.js']},
     url='https://github.com/kaaass/beancount_bot_costflow',
     install_requires=install_requires,
     license='GPLv3',