Affected: npm: vm2

# NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

**CWE**: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) chained with CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-285 (Improper Authorization) — same class the maintainer codified as Defense Invariant #13 in `lib/builtin.js` and as Category 35 / GHSA-9g8x in `docs/ATTACKS.md`.

**CVSS v3.1**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L` → 9.3 (Critical)

(Scope = Changed because the data being read and the state being written both belong to the host process, not the sandbox. Confidentiality = High because `os.userInfo()` returns host UID/GID/username/homedir + `os.networkInterfaces()` returns the full host network topology including container/VM interfaces with IPs and MAC addresses. Integrity = High because `dns.setServers()` is a process-wide write that hijacks every subsequent DNS lookup the host makes — including outbound HTTP, telemetry, npm/registry, and any host code that uses `fetch` or URL-based fs paths. Privileges Required = None because the attacker controls sandbox code, which is the threat model `NodeVM` exists to mitigate.)

## Summary

GHSA-9g8x-92q2-p28f closed the "process-wide observability builtins" class by adding `diagnostics_channel`, `async_hooks`, `perf_hooks`, and `v8` to `DANGEROUS_BUILTINS` in `lib/builtin.js`. The fix's rationale (in the commi…