A Node.js Security Game: Vulnerable or Not?