Where can I find examples of Node JS code for P2SH transactions (funding and spending) I have the following example, on which I admit I am stuck:

Bob sends 0.5 BTC to Carla, who is the owner of a P2SH address of the form 3xxxxxx. 

For Carla to spend the 0.5 BTC and pay Josh, who also has a 3xxxxxx P2SH address, she needs the redeemScript from Bob. 

Let's say she has that from Bob and Carla sends to Josh the 0.5 BTC. Now we have a TRXO of 0.5 which can be seen on blockchain explorer under Josh's address. 

To spend the TRXO, Josh also needs the redeemScript, right? Is it the same one as Bob's redeemScript?

According to Andreas's book, the redeemScript required for spending from a P2SH address is revealed after the first Output spent from the funding address.  

So simply by looking at the scriptSig: under Bob's INPUT (e.g. PUSHDATA(66)[xxxxxxxxxxxxxxxxxxxxx], and taking the redeemScript from there anyone can hash that and spend the 0.5 BTC? If so, how?

The TRXO is not based on publickey as in the case of addresses of the form 1xxxx so it's not associated with Josh's address but rather with anyone who can produce a hash of the redeemScript.   

This below explains a lot in previous chapters but the practical side of the article is still in draft.  

https://github.com/ChristopherA/Learning-Bitcoin-from-the-Command-Line/blob/master/08_5_Spending_a_P2SH_Transaction.md

The [draft] side is what I want to understand. I think this is very important because many addresses are P2SH these days. Most are multisig, yes, very secure. But if it's not multisig, isn't it a vulnerability to access the redeemScript just by looking at a previous TRX INPUT? 

I use Node JS and can access libs, on Windows + Bitcoin core.I want to test these on testnet and maybe with a small amount on Livenet.  

Thanks!
bitcoinjs-lib has examples for multisig P2SH, single-key Segwit wrapped in P2SH, and multisig Segwit wrapped in P2SH.