The flagged code is part of the bundled lodash library and uses a fixed, non-changing snippet to find the JavaScript global object. It does not run any user or network input, so it is not a security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The flagged line `Function('return this')()` appears inside webpack module 6, which is a vendored lodash build. This is lodash's standard root/global object detection pattern: it tries `freeGlobal`, then `freeSelf`, then falls back to `Function('return this')()` to obtain the global `this` reference. The argument to `Function` is a hardcoded string constant, not attacker-controlled or dynamically constructed input. There is no data flow from untrusted sources into this expression. This pattern is widely used by lodash and webpack runtime shims for environment-agnostic global access and does not constitute code injection or dynamic execution of untrusted data.
This is a standard webpack global-object shim that ships in many bundled JavaScript libraries. It uses fixed, hardcoded expressions to find the global object and does not process any user or attacker input.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Lines 1195-1206 show webpack module 3, a standard global shim: it first tries `(function(){return this})()`, then falls back to `Function('return this')()` and `(1,eval)('this')`, and finally `window`. All arguments are fixed string literals ('return this', 'this') with no dynamic or attacker-controlled content. This is the canonical webpack global polyfill pattern, executed once at module load time to resolve the global object. No untrusted input reaches these expressions. The fantastical library uses this solely to obtain a global reference for its lodash dependency.
The flagged link is just a standard JSON Schema identifier embedded in a schema object. It is not used to fetch anything or make any network call; it simply identifies which version of the JSON Schema specification the tool parameters follow.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
This is a standard pattern found in the lodash utility library, bundled inside the fantastical name generator. It is a well-known way to get a reference to the global object and does not execute any attacker-controlled code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The extension loads its companion library only from local paths within the installed extension folder, with no runtime CDN or external network calls.
Technical assessment
The ensureFantasticalLoaded function constructs candidate URLs exclusively from the extension's own served base path and local fallback paths (e.g., BASE_URL, /scripts/extensions/...). A comment explicitly states no external CDNs are used at runtime. All script loads target local, same-origin assets.