v3.10.0 introduced a breaking change

[stwiname]

With our use case we use webpack to bundle code into a single script. This happens with any package that uses inherits or the nodejs util.inherits.

With #540 this broke usage of these packages and it will result in this line throwing https://github.com/patriksimek/vm2/blob/main/lib/setup-sandbox.js#L561.

I am unsure if this change is for security reasons as the PR doesn't go into details.

Here is a minimal script to reproduce the error:

const script = `
const util = require('util');
const EventEmitter = require('events');

function MyStream() {
  console.log("This is sha1");
}

util.inherits(MyStream, EventEmitter);
`;

const vmScript = new VMScript(script);
const vm = new NodeVM({
console: 'inherit',
require: {
  builtin: ['util', 'events'],
},
});
vm.run(vmScript);

[patriksimek]

Thank you for reporting the issue. I’m afraid it was introduced as a side effect of the patch for the security vulnerabilities. Any help with fixing it is appreciated.