No Dynamic Code

Never execute dynamically constructed JavaScript code.

Correct

const result = calculateValue(input)
setTimeout(runTask, delay)

Incorrect

eval(source)
new Function(source)
setTimeout('runTask()', delay)

Fix

Replace eval, Function constructors, and string-based timer callbacks with direct function calls.