code: function evil(sandbox, code) {
    let context = vm.createContext(sandbox);
    let script = new vm.Script(code);
    try {
      return script.runInContext(context);
    }
    catch(e) {
      return null;
    }
  }
docs: Presume code is valid JS code (i.e. that it has been checked elsewhere)