This demo node.js app is to show that a super-lazy and inexperienced programmer created a production web app that loads files based on the browser's request. It's a basic app that should load index.html and all other linked files. That is... until you try something like /etc/passwd. To exploit, type in the file that you're requesting, for example:
curl http://127.0.0.1:8000/../../../../../../etc/passwd