A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The flagged code is part of a well-known helper library bundled into the extension. It uses a standard JavaScript trick to find the global object in different environments. No user input or external data is involved, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The matched `Function("return this;")()` call appears inside the bundled Microsoft reflect-metadata polyfill, which is embedded in the minified library code. This is a standard, widely-used technique to obtain a reference to the global object across different JS environments (browser, Node, worker). The argument to `Function` is a fixed string literal with no external or attacker-controlled input, so there is no dynamic code execution pathway. The code merely evaluates `return this;` to capture `globalThis` and then assigns the reflect-metadata implementation to it.
The scanner flagged code that mentions environment variables and JSON parsing, but this is from well-known libraries bundled into the Buttplug device-control library. The code checks an environment setting for a compatibility option and parses JSON as part of normal operation. No passwords, keys, or personal data are read or sent anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: The serialize-environment signal is triggered by standard bundled third-party library code. The reflect-metadata polyfill references process.env conditionally to decide whether to use a Map polyfill; no environment data is read, serialized, or transmitted. The class-transformer deserialize methods call JSON.parse on caller-supplied strings as part of normal object-to-class transformation; no credentials are accessed and no network exfiltration occurs. There is no data flow to an external destination.
The scanner noticed the word __proto__ in the code, but the code actually uses it to block prototype pollution attacks, not cause them. This is a protective measure built into a standard library. There is no demonstrated way for an attacker to exploit this code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.
Contextual assessment: The prototype-pollution signal is triggered by the presence of the string __proto__ in bundled library code. In the class-transformer transform function, the relevant code explicitly guards against prototype pollution by skipping keys named __proto__ and constructor. The EventEmitter library tests __proto__ availability for feature detection. Neither pattern introduces an attacker-controlled prototype pollution path; the code is defensive or feature-detecting, not exploitative.
The flagged code uses a fixed, hardcoded string to get the global JavaScript object. This is a standard pattern used by widely-used libraries to work across different environments. No user input is involved, and no harmful code is executed.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Line 1097 contains `Function('return this;')()` inside the Microsoft Reflect metadata polyfill (indicated by the adjacent Apache 2.0 license header and `Reflect` assignment logic). This is a well-known pattern to obtain the global object across different JS environments (Node, browser, worker). The argument to `Function()` is a fixed string literal `'return this;'` with no interpolation or user-controlled input. There is no dynamic code execution path reachable by an attacker; this is static polyfill initialization code that runs once at module load.
The flagged code checks a single environment variable to decide whether to use a compatibility workaround. It does not collect, serialize, or send any environment data anywhere. This is standard library behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: Line 1155 reads `process.env.REFLECT_METADATA_USE_MAP_POLYFILL` within the Microsoft Reflect metadata polyfill to decide whether to use native Map/Set/WeakMap or polyfilled versions. This is a single boolean feature-detection check of one named environment variable. It does not enumerate, serialize, or exfiltrate `process.env` contents. No data is sent to any external destination. This is standard polyfill configuration behavior with no attacker-controlled input path.
The flagged code is part of standard bundled libraries. It checks whether certain JavaScript features exist and actively blocks dangerous key names from being used. This is normal library behavior, not a security problem.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.
Contextual assessment: The scanner flagged `__proto__` references on line 30, but the actual code is an EventEmitter polyfill performing feature detection (`if (!new n().__proto__)` to test prototype support) and a class-transformer transform function that explicitly guards against prototype pollution by skipping `__proto__` and `constructor` keys (line 699: `if (m === '__proto__' || m === 'constructor') { return 'continue'; }`). These are mitigation patterns, not exploitation. No attacker-controlled data flow reaches these lines to cause prototype pollution; the guard actively prevents it. This is standard bundled library code from buttplug.io SDK dependencies.