The extension has a settings field where users can type their own JavaScript to customize how the tracker works. It runs that code using a standard JavaScript mechanism. This is an intentional feature of the extension and the user who types the code is the one affected by it.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: low · Exploitability: unlikely
Developer action: No change required for the core feature. Consider adding a visible warning near the mesTrackerJavascript field and when importing presets that contain JavaScript, so users understand the field executes code and shared presets may include executable content.
Imported presets can carry executable JavaScript without warning
low risk · high confidence
Detailed wording was omitted by the public report safety filter.
Technical assessment
Detailed technical wording was omitted by the public report safety filter.
Impact: low · Exploitability: unlikely
Developer action: Consider showing a confirmation or warning dialog when an imported preset contains a non-empty mesTrackerJavascript value, so users are alerted before executable code from a shared file runs.