.node native addon loading

binding.gyp runs code at compile time. This runs it at load time. When require() encounters a .node file, Node calls process.dlopen(), which maps directly to the system's dlopen(). Arbitrary native code then executes with the full permissions of the Node process. There's no sandbox and no JS-level permission check.

const addon = require('./build/Release/addon.node'); // runs native init immediately

A .node file is a shared library (.so / .dylib / .dll). Its initialization function runs the moment it loads, and it can do anything a C program can. The attack is substitution. If an attacker can replace a .node in node_modules/ through a compromised package, a writable directory or a swapped prebuilt binary, the malicious native code executes on the next require().

Unlike JavaScript, .node binaries are opaque to code review and static analysis. You can't grep a shared library for curl https://evil.com, and most scanners skip binaries. Packages that ship prebuilt binaries download .node files from URLs in package.json. If that URL is compromised or served over HTTP, the binary could be anything.