Node: restrict system/factories.json to looking in plugins

This corrects the first part of #376, but still need to understand if the second part is a glob fault...