I'll add that require can also load binary modules, so you don't even need malicious bytecode to execute arbitrary code!