Fix node inclusion

Don't you need to escape `fname`?
Similarly, `varname` should probably be `require`d to be a valid JS identifier in the first place.