Local integrity impact via symlink TOCTOU race

Time-of-check time-of-use weakness in chownr before 1.1.0 for Node.js 10.10 allows local attackers to alter ownership of unintended directories via symlink races. The package lstat-checks each child and then recursively calls chownr, allowing a pathname to be replaced by a symlink between check and use so traversal reaches an attacker-selected tree. Exploitation requires local filesystem access and a controllable race; the demonstrated consequence is unintended integrity-changing ownership modification, not direct data disclosure or service interruption.