ENDOR-VUL-2026-1

As a result of our zero-day research, we flag this dangerous package as being vulnerable. Even though the maintainer disagrees with this assessment (https://github.com/browserify/static-eval#security), i.e., they say that you should only use the package with non-attacker controlled data, we flag this package to notify all customers that use this dangerous package in production about its risks. Since there is no fix available, we recommend you migrate asap to a safer alternative or avoid using code evaluation in the first place.