OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a build-time check that makes sure the extension's own code is valid before packaging it. It does not run the code or accept outside input, so it is not a security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched `new Function(minJS)` is in a build script that reads the project's own extension JS file, applies a local minifier, and uses `new Function` solely as a syntax-validation check before writing the minified output into the extension JSON. The constructor is not invoked and no untrusted or remote input is passed to it; the only input is the developer's own source file read from the repository. This is a standard build-time parse check and does not introduce runtime dynamic execution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- build.js:73