OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The flagged code is a standard piece of a widely-used open-source library that uses a fixed, hardcoded instruction to find the global environment object. It does not run any code from users, chat messages, or the internet, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged construct is inside a bundled copy of the Microsoft Reflect metadata polyfill. The expression uses a fixed string literal to obtain the global object reference in environments where globalThis may be unavailable. No user input, network data, or external strings flow into this call. This is a standard, widely-used polyfill pattern with no dynamic code execution of untrusted data.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- lib/buttplug.js:20