Remote command injection in serial-number module for Node.js