If your npm is up-to-date it would have provided a critical warning about the use of eval in that code.