npmjs shows 1,325,674 weekly downloads. The current version was released 3 years ago. The code is small and straightforward. Using exec("cat x " + userdata)

npmjs shows 1,325,674 weekly downloads. The current version was released 3 years ago. The code is small and straightforward. Using exec("cat x " + userdata) to read a file in any language should immediately drive any developer nuts. Apparently, nobody ever looked at the code. Or maybe some people did, but never reported it. Pretty sure some companies did, fixed it in their closed local fork and never notified the author nor contributed their fix back. This is really scary, and really bad for the trustworthiness of open-source software.