@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input (CVE-2026-44728) | HOL Guard CVE