The published npm package "praisonai" exports a TypeScript built-in tool named "codeMode". The package describes this tool as executing code in a sandboxed environment, marks its capability as "sandbox: true", and registers it through the public tools facade. The implementation does not create an isolation boundary. It applies a small regular-expression blocklist, sets "process" and "require" to "undefined" inside a plain JavaScript object, and then executes attacker-controlled code with the host process "new Function" constructor: Because this runs in the host V8 context, code inside "codeMode" can use the JavaScript prototype chain to recover the real "Function" constructor: From a normal CommonJS application script, the recovered "process" object exposes "process.mainModule.require". That bypasses the explicit "require('fs')" and "require('child_process')" controls and allows host filesystem access and subprocess execution from code that was supposed to be sandboxed.