I'm seeing some really interesting JavaScript techniques in the turtlevm.js[1] source.
This line in particular stands out: const code = String(work).trim().split("{").slice(1).join("{").slice(0, - 1).trim().replace("/0/", _turtlevmapi).replace("/1/", strCode);
It looks like the author is injecting the turtle code written by the user into a "work" function that removes dangerous objects (XMLHttpRequest, WebSocket, etc).
Can someone with experience writing a VM in JS point to a good reference on the topic?