GHSA-m5w8-4gq2-6f8x: vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

GHSA-9g8x-92q2-p28f closed the “process-wide observability builtins” class by adding diagnostics_channel, async_hooks, perf_hooks, and v8 to DANGEROUS_BUILTINS in lib/builtin.js. The fix’s rationale (in the commit message and docs/ATTACKS.md Category 35) is general:

Process-wide observability builtins. Unlike most Node builtins, these expose state of the entire host process rather than sandbox-local state — the vm2 boundary cannot usefully contain them because the data they surface […] belongs to the embedder. Even a readonly proxy that forwards every call to the host module is a working host-data exfiltration primitive.

Two builtins satisfying the same description were not added: os and dns. Both are reachable today under the documented builtin: ['*'] configuration; both expose host-process state that the vm.readonly() proxy cannot localise; and both have write APIs that mutate global host-process state from the sandbox (os.setPriority(), dns.setServers(), dns.setDefaultResultOrder()). dns.setServers() in particular turns sandbox code into a process-wide DNS hijack primitive — strictly worse than every read-only leak that GHSA-9g8x added.

Adding os and dns to DANGEROUS_BUILTINS extends the same fix to the rest of the class. The existing isDangerousBuiltin(key) family-prefix matcher (added by GHSA-rp36-8xq3-r6c4) automatically catches node:os, node:dns, and node:dns/promises once the family names are present.