JavaScript Security Best Practices

const calc = new Function('a', 'b', 'return a + b');

It's slower than regular functions
It creates memory leaks
It can execute arbitrary code like eval()
The Function constructor is similar to eval() in terms of security risks. It can execute arbitrary JavaScript code from strings, making it vulnerable to code injection attacks. Like eval(), it can execute any code in the global scope, potentially compromising your application's security. Always use regular functions or arrow functions instead of the Function constructor.
It doesn't support closures