Sacrasm aside, saying "node.js" strongly implies use of npm, and that means pulling a lot (think deps-of-deps-of-deps) of potentially unaudited code off the network, without much authentication.

Not something one would fancy for a tool that handles sensitive data.