* Prototype pollution
* Trigger exception and `require()` gadget
* Find gadgets to RCE

Original writeup (https://ctf.zeyu2001.com/2022/balsnctf-2022/2linenodejs).