node-serialize's unserialize() executes embedded function bodies (`$$ND_FUNC$$`) — deserializing untrusted input is remote code execution.
Never unserialize untrusted data. Use JSON.parse for data; if you need typed objects, validate against a schema.