This is a common, harmless snippet from a widely used helper library that simply finds the global environment object. It does not run any user-supplied code and poses no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged expression is a static `Function('return this')()` call inside a vendored lodash module bundled within the fantastical library. This is lodash's standard idiom for resolving the global object at module load time when `global` and `self` are unavailable. The argument is a hardcoded string literal, not user input or remote data, so there is no injection vector.
This code is a routine boilerplate snippet found in bundled JavaScript libraries used to find the global object (like window in a browser). It does not run any user-supplied or remote code; it only evaluates fixed text to locate the global scope. This is normal and expected for a vendored library file.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched line is part of a standard webpack/browser-bundle global-object polyfill. It attempts to resolve the global reference via several fallbacks, including Function('return this')() and indirect eval of the literal 'this'. No attacker-controlled or dynamic data is passed to eval or Function; the operands are constant string literals used solely to obtain the global scope. This is a common pattern in vendored bundled libraries and does not introduce dynamic code execution of external input.
This is a common, harmless trick bundled libraries use to find the global JavaScript object. It runs a fixed piece of code with no outside input, so there is no way for an attacker to influence it.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged line is the standard lodash-style global object resolution idiom used in a vendored browser build of the fantastical library. Function('return this')() executes a static string with no user-controlled input and is used solely to obtain a reference to the global object when freeGlobal and freeSelf are unavailable. No data flows into this call from extension users, SillyTavern state, or network sources.
The matched code is part of a bundled third-party library and uses a standard method to access the JavaScript global object. It does not handle any user data or secrets.
Technical assessment
The surrounding code is a vendored browser build of the fantastical name-generation library, containing lodash-style utility helpers. The Function constructor call is a static global-resolution pattern and does not process extension inputs, credentials, or network data.
The flagged line is part of a standard helper library routine for detecting the runtime environment, not a dynamic code execution risk.
Technical assessment
The surrounding code is a webpack-injected lodash module that resolves `root` via `freeGlobal || freeSelf || Function('return this')()`. This is a well-known lodash pattern with a constant string argument and no data flow from external inputs.