JavaScript, Nodejs, Security, NPM.
it could even monkey-patch the methods provided by the internal crypto module. This could be used to send any string of text that the process encrypts to a third party. This would affect other modules which have crypto as a dependency, such as database modules performing auth or the bcrypt module