[tptacek]

It appears to be using Node's crypto library to apply the RSA transform directly to the plaintext in modulus-size chunks. The problem isn't the quality of the RSA implementation.

[sarciszewski]

Which means for an arbitrary length message, you can rearrange blocks and it will decrypt (and the victim is none the wiser).