vm2: NodeVM builtin:['*'] Exposes os and dns — Host Process Exposure From the Sandbox

A critical vulnerability in the vm2 npm package breaks the sandbox isolation that NodeVM is designed to enforce. When configured with builtin: ['*'], two Node.js built-in modules — os and dns — slip through the dangerous-builtin filter. Both expose host-process state that the vm2 boundary cannot contain, and both carry write APIs that mutate global host-process state from the sandbox.