packages/ts-invariant/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ts-invariant",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "author": "Ben Newman <ben@apollographql.com>",
   "description": "TypeScript implementation of invariant(condition, message)",
   "license": "MIT",

packages/ts-invariant/process/index.js

@@ -7,7 +7,13 @@ var safeGlobal = (
   maybe(function() { return window }) ||
   maybe(function() { return self }) ||
   maybe(function() { return global }) ||
-  maybe(function() { return Function("return this")() })
+  // We don't expect the Function constructor ever to be invoked at runtime, as
+  // long as at least one of globalThis, window, self, or global is defined, so
+  // we are under no obligation to make it easy for static analysis tools to
+  // detect syntactic usage of the Function constructor. If you think you can
+  // improve your static analysis to detect this obfuscation, think again. This
+  // is an arms race you cannot win, at least not in JavaScript.
+  maybe(function() { return maybe.constructor("return this")() })
 );
 
 var needToRemove = false;