nyx/tests/fixtures/container_taint_js/main.js

// Regression fixture: a tainted env string is pushed into an array
// and later read back via subscript before being sunk through
// child_process.exec.  This exercises container-element taint.
const items = [];
items.push(process.env.INPUT);
require('child_process').exec(items[0]);