This is part of the official Vaadin web component library bundled with the project. It only runs special diagnostic code when the app is running locally in development mode, and the relevant statistics function is empty in this build. It is not a security threat.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched dynamic execution is inside Vaadin's development-mode detector in a vendored bundle. The function uncommentAndRun extracts commented-out code from a callback's source and compiles it via new Function, but only executes when window.Vaadin.developmentMode is true. That flag is gated by localhost checks, forced-development-mode localStorage, and production-mode settings. The only callback passed in this build is maybeGatherAndSendStats, which is an empty function. This is a standard, well-known Vaadin library pattern and does not introduce attacker-controlled input or exfiltration.
This is a test script checking whether a local server has started up. It sends a simple 'are you ready?' request with no sensitive information attached. There is no credential theft here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.
Contextual assessment: The flagged line is a GET request to a health-check endpoint inside a Playwright end-to-end test script. The request carries no credentials, headers, or body; it simply polls a local server for readiness. The scanner likely correlated process.env usage (passed to a spawned child server at a nearby line) with this network call, but the two are unrelated: the environment is forwarded to a local child process for test setup, and the fetch is a parameterless health probe to a localhost URL.
This is a standard piece of bundled third-party library code used to find the global JavaScript object. It does not run any user or network input, only fixed internal text, so it is not a security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched line is inside a vendored webpack bundle for Nunjucks. It is the standard webpack global-object shim that resolves a reference to the global scope by trying Function('return this')() and (1,eval)('this') with static string literals. No user-controlled or remote data is passed to eval; the operands are constant strings used solely to obtain the global reference. This is a common, benign pattern in bundled JavaScript libraries.
Credential access and network transmission in one file
Expected behavior · high confidence
The test file both starts a local server (passing along environment variables) and makes a simple network request to check if that server is ready. These are normal test activities and are not connected in a way that would leak secrets.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The rule flags co-occurrence of a credential source and a network sink in the same file. Here the credential-adjacent code is the forwarding of process.env to a spawned local server process for test orchestration, and the network sink is a GET health-check fetch to a localhost URL. No credentials are extracted, read, or transmitted to the network sink. The two data flows are independent and serve the legitimate purpose of starting and verifying a local test server.
This is part of a standard third-party template engine called Nunjucks. Template engines convert text templates into runnable code so they can render pages quickly. Using dynamic code generation is how this library is designed to work. There is no sign of anything unusual or malicious here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched line is inside a vendored copy of the Nunjucks templating engine. The `new Function(source)` call is Nunjucks' standard template compilation mechanism: it compiles a template string into a JavaScript render function at runtime. This is the documented and expected behavior of the library. The source passed to `new Function` is generated by Nunjucks' own compiler from template text, not from arbitrary external input. The file role is vendored and the code matches the upstream library's known implementation.
Environment forwarding to spawned test server is standard test setup
low risk · high confidence
When running automated tests, the script starts a copy of the app on the same machine and passes along normal environment settings. This is expected and does not send any secrets anywhere outside the local test environment.
Technical assessment
The test script spawns the project server with the full process.env plus a color override. This is the conventional way to launch a local server for integration testing and does not constitute credential exfiltration. The environment variables are consumed by the local child process, not transmitted to an external endpoint.
The library uses a common trick to find the global JavaScript environment. Because it only uses fixed internal text and never user content, it is safe.
Technical assessment
The module at webpack module id 14 resolves the global object by first using a closure return of this, then falling back to Function('return this')() and (1,eval)('this'). Both eval-style calls use constant string literals and do not incorporate external input, so there is no injection surface.
Vaadin development-mode statistics collection is disabled
low risk · high confidence
The Vaadin usage statistics feature that normally accompanies this code path has been emptied out, so no data is collected or sent.
Technical assessment
The maybeGatherAndSendStats function is defined as an empty body, and usageStatistics only invokes it through runIfDevelopmentMode, which is gated by the development-mode flag. No network or telemetry behavior is present in this build.