OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that loads the extension's own backend module in a fake environment to run automated checks. It only runs when a developer types the test command, is not part of what users install, and does not execute anything from outside the project.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged dynamic execution is a test harness that loads the project's own built backend module via new Function, passing a mock spindle object. The file role is test, the project README states tests are not shipped or loaded by the extension, and the executed code is the project's own dist/backend.js read locally, not user input or remote content. This is a standard pattern for exercising a module that expects a host-provided runtime object.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- test/word-swaps.test.ts:72