The flagged code is part of a well-known third-party AI library (ONNX Runtime Web) that this extension bundles for local image processing. The library uses a standard technique to connect JavaScript with its internal WebAssembly engine. No user input or external data is passed into this mechanism, so it cannot be abused to run harmful code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged dynamic execution is a `new Function` call inside the bundled ONNX Runtime Web v1.27.0 library (Microsoft, MIT-licensed). It belongs to Emscripten's embind binding layer, which generates method-caller wrappers to bridge JavaScript and the compiled WebAssembly module. The function body is assembled from internal type-registration metadata (registered C++ class names, argument converters, and calling conventions), not from user input, network data, or extension configuration. No attacker-controlled data reaches the `new Function` arguments. This pattern is standard in Emscripten-generated code and is proportional to the project's stated purpose of running a local ONNX inference model in the browser.
This file is part of the official ONNX Runtime Web library, which the extension uses to run AI image processing locally in the browser. The flagged code is the library's internal machinery for connecting JavaScript to its compiled core. It is generated by the library itself, not by the extension author, and does not use any user input or network data. This is normal for this kind of library.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched `new Function` occurs inside the Emscripten-generated embind glue of ONNX Runtime Web (ort-wasm-simd-threaded.asyncify.mjs). It constructs a method-caller wrapper that marshals arguments between JavaScript and compiled WASM exports. The function body is assembled from internal type descriptors and argument pointer helpers, not from user input, network data, or extension configuration. This is a standard pattern in onnxruntime-web 1.27.0, which the project depends on for local Real-ESRGAN inference. No external or attacker-controlled data reaches the generated function source.
Emscripten embind new Function in bundled ONNX Runtime Web
low risk · high confidence
This is a routine code-generation step inside the bundled AI runtime. It creates small helper functions to call into the compiled engine and does not accept any outside input.
Technical assessment
The `new Function(Object.keys(g), b)(...Object.values(g))` call constructs a method-caller closure from Emscripten embind type-registration data. The string `b` is built from internal converter names and calling-convention constants, not from external input. This is the standard embind code-generation pattern used to efficiently dispatch calls from JavaScript into the WebAssembly heap.