Here's the offending line of code[1]:

     exec("cat /sys/class/net/" + iface + "/address", function (err, out) {

That's some serious amateur hour and may even be a new contender for the Useless Use of Cat (and "exec(...)") Award.

Would be simpler and less error prone to just read the file via fs.readFile(...) after verifying that the iface parameter does not contain a directory separator.

[1]: https://github.com/scravy/node-macaddress/blob/dd079620d11c9...